---
id: CVE-2026-109365
title: >-
  Zebra before 6.4.0 contains an uncontrolled resource consumption vulnerability
  that allows unauthenticated peers to force full proof verification by serving
  forged block bodies with valid header hashes
summary: >-
  Zebra before 6.4.0 contains an uncontrolled resource consumption vulnerability
  that allows unauthenticated peers to force full proof verification by serving
  forged block bodies with valid header hashes. Attackers can flip
  authorizing-onl…
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L'
cwe:
  - CWE-345
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T17:17:34.247'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-109365'
references:
  - url: >-
      https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-3c94-hf7p-g5mf
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/zebra-before-6.4.0-denial-of-service-via-same-hash-forged-block-bodies
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-12T18:00:08.215Z'
---

## Overview

Zebra before 6.4.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated peers to force full proof verification by serving forged block bodies with valid header hashes. Attackers can flip authorizing-only bytes such as a coinbase scriptSig, wasting Sapling, Orchard, and Ironwood proof verification without penalty and stalling sync for 67 seconds.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.