CVE-2026-109366

The Zebra software, prior to version 6.4.0 , is vulnerable to an improper integrity validation flaw in the inbound gossip download path. This allows unauthenticated peers to force the dropping of new blocks without penalty by serving a real block with a rewritten coinbase scriptSig set to height ...

CVE-2026-104422

The block sync download path in Zebra zebrad before 6.3.0 reads a block's height from its unvalidated coinbase scriptSig and drops blocks that appear too far behind the tip before consensus validation, without penalizing the supplying peer. Because V5 transaction IDs exclude the scriptSig, a...

CVE-2026-104422

Zebra (zebrad) versions before 6.3.0 are vulnerable to a Denial of Service (DoS) attack in the block sync download path. The software reads a block's height from an unvalidated coinbase scriptSig and drops blocks that appear too far behind the tip before consensus validation occurs, without penal...

CVE-2026-104422 Zebra before 6.3.0 Block Sync Denial of Service via Coinbase scriptSig Rewrite

The block sync download path in Zebra zebrad before 6.3.0 reads a block's height from its unvalidated coinbase scriptSig and drops blocks that appear too far behind the tip before consensus validation, without penalizing the supplying peer. Because V5 transaction IDs exclude the scriptSig, a...

CVE-2026-104422 Zebra before 6.3.0 Block Sync Denial of Service via Coinbase scriptSig Rewrite

The block sync download path in Zebra zebrad before 6.3.0 reads a block's height from its unvalidated coinbase scriptSig and drops blocks that appear too far behind the tip before consensus validation, without penalizing the supplying peer. Because V5 transaction IDs exclude the scriptSig, a...

CVE-2026-104422 Zebra before 6.3.0 Block Sync Denial of Service via Coinbase scriptSig Rewrite

The block sync download path in Zebra zebrad before 6.3.0 reads a block's height from its unvalidated coinbase scriptSig and drops blocks that appear too far behind the tip before consensus validation, without penalizing the supplying peer. Because V5 transaction IDs exclude the scriptSig, a...

CVE-2026-104422: Insufficient Verification of Data Authenticity

The block sync download path in Zebra zebrad before 6.3.0 reads a block's height from its unvalidated coinbase scriptSig and drops blocks that appear too far behind the tip before consensus validation, without penalizing the supplying peer. Because V5 transaction IDs exclude the scriptSig, a...