CVE-2026-109363GHSA-h5rr-8pqv-grp9
Zebra 6.4.0 before 6.4.2 Denial of Service via Malformed v6 Transaction
ZcashFoundation zebra
CVSS
8.7HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.43%Chance of exploitation activity in the next 30 days, higher than 36% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 6.4.2zebraCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
ZcashFoundation Zebra 6.4.0 before 6.4.2 parses version 6 transactions carrying a pre-NU6.3 consensus branch ID, but the size computation during UnminedTx construction treats re-serialization of the Orchard bundle as infallible, so the resulting error trips an expect that aborts zebrad. Unauthenticated peers can send a single pre-handshake tx message to crash the node, and can repeat this after each restart.
Text from CVE List
Affected versions 2
- zebraaffected: 6.4.0 before 6.4.2CVE List
- zebraunaffected: 6.4.2CVE List
References 3
- github.com/ZcashFoundation/zebra/commit/008abac5c99e872f283450d596d95e37851df49aFixvia CVE List
- github.com/ZcashFoundation/zebra/security/advisories/GHSA-h5rr-8pqv-grp9Advisoryvia CVE List
- vulncheck.com/advisories/zebra-6.4.0-before-6.4.2-denial-of-service-via-malformed-v6-transactionAdvisoryvia CVE List