---
id: CVE-2026-104422
title: >-
  The block sync download path in Zebra (zebrad) before 6.3.0 reads a block's
  height from its unvalidated coinbase scriptSig and drops blocks that appear
  too far behind the tip before consensus validation, without penalizing the
  supplying …
summary: >-
  The block sync download path in Zebra (zebrad) before 6.3.0 reads a block's
  height from its unvalidated coinbase scriptSig and drops blocks that appear
  too far behind the tip before consensus validation, without penalizing the
  supplying …
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-345
vendor: ZcashFoundation
product: zebra
affected:
  - zebra < 6.3.0
published: '2026-10-02'
updated: '2026-10-02'
sourceUpdated: '2026-10-02T12:17:12.283'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-104422'
references:
  - url: >-
      https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-g95h-hw6g-pvgv
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/zebra-before-6.3.0-block-sync-denial-of-service-via-coinbase-scriptsig-rewrite
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-10-02T12:17:44.330Z'
---

## Overview

The block sync download path in Zebra (zebrad) before 6.3.0 reads a block's height from its unvalidated coinbase scriptSig and drops blocks that appear too far behind the tip before consensus validation, without penalizing the supplying peer. Because V5 transaction IDs exclude the scriptSig, a malicious peer can repeatedly serve a canonical block whose coinbase claims height 1 while keeping the requested hash, delaying the node's discovery of the newest block.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.