CVE-2026-109363

Name of the Vulnerable Software and Affected Versions ZcashFoundation Zebra versions 6.4.0 through 6.4.1

Description The software incorrectly parses version 6 transactions that carry a pre-NU6.3 consensus branch ID. During the construction of UnminedTx, the size computation assumes that the re-serialization of the Orchard bundle will always succeed. When an error occurs during this process, it triggers an expect condition that causes the zebrad process to abort. This allows unauthenticated peers to crash the node by sending a single pre-handshake transaction message, which can be repeated after the node restarts.

Recommendations Update ZcashFoundation Zebra to version 6.4.2.