8 matches found
CVE-2026-109366
The Zebra software, prior to version 6.4.0 , is vulnerable to an improper integrity validation flaw in the inbound gossip download path. This allows unauthenticated peers to force the dropping of new blocks without penalty by serving a real block with a rewritten coinbase scriptSig set to height ...
CVE-2026-109366 Zebra before 6.4.0 Gossiped Block Drop via Forged Coinbase scriptSig Height
Zebra before 6.4.0 contains an improper integrity validation vulnerability in the inbound gossip download path that allows unauthenticated peers to force dropping of new blocks without penalty. Attackers can serve a real block with a coinbase scriptSig rewritten to height 1, which keeps the ZIP-2...
CVE-2026-104422
The block sync download path in Zebra zebrad before 6.3.0 reads a block's height from its unvalidated coinbase scriptSig and drops blocks that appear too far behind the tip before consensus validation, without penalizing the supplying peer. Because V5 transaction IDs exclude the scriptSig, a...
CVE-2026-104422 Zebra before 6.3.0 Block Sync Denial of Service via Coinbase scriptSig Rewrite
The block sync download path in Zebra zebrad before 6.3.0 reads a block's height from its unvalidated coinbase scriptSig and drops blocks that appear too far behind the tip before consensus validation, without penalizing the supplying peer. Because V5 transaction IDs exclude the scriptSig, a...
CVE-2026-104422
Zebra (zebrad) versions before 6.3.0 are vulnerable to a Denial of Service (DoS) attack in the block sync download path. The software reads a block's height from an unvalidated coinbase scriptSig and drops blocks that appear too far behind the tip before consensus validation occurs, without penal...
CVE-2026-104422 Zebra before 6.3.0 Block Sync Denial of Service via Coinbase scriptSig Rewrite
The block sync download path in Zebra zebrad before 6.3.0 reads a block's height from its unvalidated coinbase scriptSig and drops blocks that appear too far behind the tip before consensus validation, without penalizing the supplying peer. Because V5 transaction IDs exclude the scriptSig, a...
CVE-2026-104422 Zebra before 6.3.0 Block Sync Denial of Service via Coinbase scriptSig Rewrite
The block sync download path in Zebra zebrad before 6.3.0 reads a block's height from its unvalidated coinbase scriptSig and drops blocks that appear too far behind the tip before consensus validation, without penalizing the supplying peer. Because V5 transaction IDs exclude the scriptSig, a...
CVE-2026-104422: Insufficient Verification of Data Authenticity
The block sync download path in Zebra zebrad before 6.3.0 reads a block's height from its unvalidated coinbase scriptSig and drops blocks that appear too far behind the tip before consensus validation, without penalizing the supplying peer. Because V5 transaction IDs exclude the scriptSig, a...