Cpe:2.3:a:zcashfoundation:zebra:6.4.0:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3azcashfoundationzebra6.4.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 12 Oct 2026 18:38:22 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgDenial of Service in ZcashFoundation Zebra Nodehttps://feed.craftedsignal.io/briefs/2026-10-zebra-dos/Mon, 12 Oct 2026 18:38:22 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-zebra-dos/A vulnerability in ZcashFoundation Zebra 6.4.0 and 6.4.1 allows unauthenticated remote attackers to crash the node by sending a crafted version 6 transaction with a pre-NU6.3 consensus branch ID.ZcashFoundation Zebra versions 6.4.0 through 6.4.1 contain a denial-of-service vulnerability arising from improper error handling during the processing of specific transaction types. The issue occurs when the node parses a version 6 transaction that carries a pre-NU6.3 consensus branch ID. During the construction of an UnminedTx, the size computation logic assumes that the re-serialization of the Orchard bundle is always successful. If this assumption fails, the application triggers an assertion error, which results in an immediate crash of the zebrad process. Because this message can be sent by unauthenticated peers as a pre-handshake transaction, remote attackers can persistently crash the node by repeatedly sending the malicious payload after every restart, effectively disrupting the availability of the Zebra node on the Zcash network.

Impact

The vulnerability allows for trivial, persistent denial-of-service attacks against Zebra nodes running vulnerable versions. By sending a single crafted packet, an attacker can crash the node. If the service is automatically restarted by a manager, the attacker can repeat the attack indefinitely, preventing the node from participating in network consensus and processing transactions. This impact is critical for operators of Zebra nodes who rely on consistent uptime for network synchronization and verification.

Recommendation

  • Upgrade all instances of ZcashFoundation Zebra to version 6.4.2 or later to include the mandatory error handling fix for Orchard bundle re-serialization.
  • Monitor network logs for a high frequency of incoming 'tx' messages followed immediately by zebrad service termination or restart events.
  • Patch CVE-2026-109363 across all Zebra node infrastructure immediately.
]]>lowadvisory