CVE-2026-109366

Name of the Vulnerable Software and Affected Versions Zebra versions prior to 6.4.0

Description An improper integrity validation issue exists in the inbound gossip download path. This allows unauthenticated peers to force the dropping of new blocks without penalty. An attacker can achieve this by serving a real block with a coinbase scriptSig rewritten to height 1, which maintains the ZIP-244 block hash. This action triggers a behind-tip drop before consensus validation occurs, resulting in delayed tip discovery for mining backends.

Recommendations Update Zebra to version 6.4.0 or later.