Zebra (< 6.3.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/zebra--6.3.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 02 Oct 2026 12:24:07 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgDenial of Service via Unvalidated Coinbase Height in Zebra (zebrad)https://feed.craftedsignal.io/briefs/2026-10-zebrad-dos/Fri, 02 Oct 2026 12:24:07 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-zebrad-dos/An unvalidated coinbase height input in Zebra prior to 6.3.0 allows malicious peers to induce synchronization stalls and prevent nodes from reaching the latest chain tip.Zebra (zebrad) versions before 6.3.0 contain a vulnerability in the block sync download path that allows remote attackers to perform a Denial of Service (DoS) attack. The issue stems from the node reading a block's height directly from an unvalidated coinbase scriptSig. Because V5 transaction IDs in this protocol exclude the scriptSig, an attacker can manipulate the reported height in the coinbase while maintaining a canonical block hash. By serving blocks that claim an incorrect height (e.g., height 1) while requesting the latest chain tip, a malicious peer can force the target node to drop blocks that appear too far behind the current state. Crucially, the node fails to penalize the source of these invalid blocks, allowing the attacker to repeatedly stall the victim's synchronization progress and prevent the node from discovering the actual newest block on the network. This impacts the availability and consensus participation of affected nodes.

Impact

The successful exploitation of CVE-2026-104422 results in a persistent denial-of-service condition for Zebra nodes. Affected nodes may fail to synchronize with the network, preventing them from validating or relaying transactions and blocks. This could lead to a loss of network participation and availability for services relying on Zebra, with potential impacts on transaction latency and node reliability within the Zcash ecosystem.

Recommendation

  • Upgrade Zebra (zebrad) to version 6.3.0 or later to ensure proper validation of block heights during synchronization.
  • Monitor logs for repeated sync failures or blocks rejected due to height discrepancies from specific peer IP addresses.
  • Implement network-level rate limiting or peer reputation management to identify and disconnect peers frequently transmitting invalid block data.
]]>lowadvisory