---
id: CVE-2026-109366
title: >-
  Zebra before 6.4.0 contains an improper integrity validation vulnerability in
  the inbound gossip download path that allows unauthenticated peers to force
  dropping of new blocks without penalty
summary: >-
  Zebra before 6.4.0 contains an improper integrity validation vulnerability in
  the inbound gossip download path that allows unauthenticated peers to force
  dropping of new blocks without penalty. Attackers can serve a real block with
  a coi…
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L'
cwe:
  - CWE-354
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T17:17:34.393'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-109366'
references:
  - url: >-
      https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-4f6v-mj46-gxg3
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/zebra-before-6.4.0-gossiped-block-drop-via-forged-coinbase-scriptsig-height
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-12T18:00:08.215Z'
---

## Overview

Zebra before 6.4.0 contains an improper integrity validation vulnerability in the inbound gossip download path that allows unauthenticated peers to force dropping of new blocks without penalty. Attackers can serve a real block with a coinbase scriptSig rewritten to height 1, which keeps the ZIP-244 block hash, triggering a behind-tip drop before consensus validation and delaying tip discovery for mining backends.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.