{"id":"CVE-2026-104422","state":"PUBLISHED","title":"Zebra before 6.3.0 Block Sync Denial of Service via Coinbase scriptSig Rewrite","description":"The block sync download path in Zebra (zebrad) before 6.3.0 reads a block's height from its unvalidated coinbase scriptSig and drops blocks that appear too far behind the tip before consensus validation, without penalizing the supplying peer. Because V5 transaction IDs exclude the scriptSig, a malicious peer can repeatedly serve a canonical block whose coinbase claims height 1 while keeping the requested hash, delaying the node's discovery of the newest block.","publishedAt":"2026-10-02T11:38:03.646Z","updatedAt":"2026-10-02T17:35:03.530Z","severity":{"score":8.7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["ZcashFoundation zebra"],"affected":[{"vendor":"ZcashFoundation","product":"zebra","packageURL":"pkg:cargo/Zebrad","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"6.3.0","versionType":"semver"},{"version":"6.3.0","status":"unaffected","versionType":"semver"}]}],"references":["https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-g95h-hw6g-pvgv","https://www.vulncheck.com/advisories/zebra-before-6.3.0-block-sync-denial-of-service-via-coinbase-scriptsig-rewrite"],"weaknesses":["CWE-345"],"ingestedAt":"2026-10-29T20:10:23.711Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/104xxx/CVE-2026-104422.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-104422","state":"PUBLISHED","datePublished":"2026-10-02T11:38:03.646Z","dateUpdated":"2026-10-02T17:35:03.530Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-10-02T00:46:23.830Z"},"containers":{"cna":{"title":"Zebra before 6.3.0 Block Sync Denial of Service via Coinbase scriptSig Rewrite","descriptions":[{"lang":"en","value":"The block sync download path in Zebra (zebrad) before 6.3.0 reads a block's height from its unvalidated coinbase scriptSig and drops blocks that appear too far behind the tip before consensus validation, without penalizing the supplying peer. Because V5 transaction IDs exclude the scriptSig, a malicious peer can repeatedly serve a canonical block whose coinbase claims height 1 while keeping the requested hash, delaying the node's discovery of the newest block."}],"affected":[{"vendor":"ZcashFoundation","product":"zebra","packageURL":"pkg:cargo/Zebrad","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"6.3.0","versionType":"semver"},{"version":"6.3.0","status":"unaffected","versionType":"semver"}]}],"references":[{"url":"https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-g95h-hw6g-pvgv","tags":["vendor-advisory"],"name":"GitHub Security Advisory (GHSA-g95h-hw6g-pvgv)"},{"url":"https://www.vulncheck.com/advisories/zebra-before-6.3.0-block-sync-denial-of-service-via-coinbase-scriptsig-rewrite","name":"VulnCheck Advisory: Zebra before 6.3.0 Block Sync Denial of Service via Coinbase scriptSig Rewrite","tags":["third-party-advisory"]}],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH"}},{"format":"CVSS","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-345","lang":"en","description":"Insufficient Verification of Data Authenticity","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-10-02T11:38:03.646Z"},"datePublic":"2026-08-11T00:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:zfnd:zebra:*:*:*:*:*:*:*:*","versionEndExcluding":"6.3.0"}]}]}],"credits":[{"lang":"en","value":"upbqdn","type":"finder"}],"x_generator":{"engine":"vulncheck-endgame"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-10-02T17:34:45.949504Z","id":"CVE-2026-104422","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-02T17:35:03.530Z"}}]}}}