Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ZcashFoundation | zebra | unaffected |
|
No data.
No data.
No data available yet.
No solution or workaround provided in the CVE record.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Mon, 12 Oct 2026 16:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Zebra before 6.4.0 contains an improper integrity validation vulnerability in the inbound gossip download path that allows unauthenticated peers to force dropping of new blocks without penalty. Attackers can serve a real block with a coinbase scriptSig rewritten to height 1, which keeps the ZIP-244 block hash, triggering a behind-tip drop before consensus validation and delaying tip discovery for mining backends. | |
| Title | Zebra before 6.4.0 Gossiped Block Drop via Forged Coinbase scriptSig Height | |
| First Time appeared |
Zfnd
Zfnd zebra |
|
| Weaknesses | CWE-354 | |
| CPEs | cpe:2.3:a:zfnd:zebra:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Zfnd
Zfnd zebra |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-10-12T16:05:43.620Z
Reserved: 2026-10-12T14:21:32.595Z
Link: CVE-2026-109366
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-12T17:17:34.393
Modified: 2026-10-12T17:17:34.393
Link: CVE-2026-109366
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-354
Improper Validation of Integrity Check Value