CVE-2026-109363: Reachable Assertion in ZcashFoundation zebra
Description
ZcashFoundation Zebra versions 6.4.0 up to but not including 6.4.2 contain a vulnerability where parsing certain version 6 transactions causes an assertion failure that crashes the node. This occurs because the size computation during UnminedTx construction assumes re-serialization of the Orchard bundle cannot fail, triggering an abort on error. Unauthenticated remote peers can exploit this by sending a single pre-handshake transaction message to crash the node repeatedly after restarts.
CVSS v4.0
Score 8.7high
Affected software
ZcashFoundation
zebra
pkg:cargo/github/ZcashFoundation/zebraRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
ZcashFoundation Zebra versions >=6.4.0 and <6.4.2 parse version 6 transactions with a pre-NU6.3 consensus branch ID. During UnminedTx construction, the code treats re-serialization of the Orchard bundle as infallible, but if an error occurs, it triggers an assertion failure that aborts the zebrad process. This vulnerability allows unauthenticated peers to send a single pre-handshake transaction message that crashes the node, and this can be repeated after each restart, causing a denial of service.
Potential Impact
An unauthenticated attacker can cause a denial of service by crashing the Zebra node through a crafted transaction message sent before handshake completion. This disrupts node availability and can be repeated indefinitely, impacting network reliability and node operation.
Mitigation Recommendations
A fix is available in Zebra version 6.4.2 and later. Users should upgrade to version 6.4.2 or newer to remediate this vulnerability. Until then, nodes remain vulnerable to unauthenticated remote crashes via crafted transaction messages.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-12T14:21:32.594Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6acd0c192cdf04f656b11c19
Added to database: 10/12/2026, 16:34:33 UTC
Last enriched: 10/12/2026, 16:48:35 UTC
Last updated: 10/12/2026, 21:46:38 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.