{"id":"CVE-2026-104422","published":"2026-10-02T12:17:12.283","lastModified":"2026-10-02T18:17:01.303","description":"The block sync download path in Zebra (zebrad) before 6.3.0 reads a block's height from its unvalidated coinbase scriptSig and drops blocks that appear too far behind the tip before consensus validation, without penalizing the supplying peer. Because V5 transaction IDs exclude the scriptSig, a malicious peer can repeatedly serve a canonical block whose coinbase claims height 1 while keeping the requested hash, delaying the node's discovery of the newest block.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-345"],"vendors":[],"products":[],"references":[{"url":"https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-g95h-hw6g-pvgv","tags":[]},{"url":"https://www.vulncheck.com/advisories/zebra-before-6.3.0-block-sync-denial-of-service-via-coinbase-scriptsig-rewrite","tags":[]}],"exploitRefs":[{"url":"https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-g95h-hw6g-pvgv","tags":[]}],"hasPoc":true,"ai":{"summary":"Zebra nodes are vulnerable to a denial-of-service attack where malicious peers can delay block synchronization by manipulating the coinbase scriptSig to claim false block heights. This allows attackers to keep nodes from discovering the newest blocks, effectively stalling the blockchain sync process.","exploitability":"Exploitation is relatively straightforward as it requires only a malicious peer to serve blocks with false coinbase heights, but it needs the attacker to control at least one peer in the network that can feed blocks to the vulnerable node.","blast_radius":"The impact could be significant for full nodes that rely on accurate block height information for synchronization, potentially causing them to stall or delay processing of new blocks for extended periods.","remediation":"Upgrade to Zebra version 6.3.0 or later to fix the coinbase scriptSig validation issue.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["denial-of-service","blockchain","consensus"],"model":"garnet-coder","analyzedAt":"2026-10-12T09:03:48.083Z"}}