{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/zebra-6.4.0-6.4.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:zcashfoundation:zebra:6.4.0:*:*:*:*:*:*:*","cpe:2.3:a:zcashfoundation:zebra:6.4.1:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-109363"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Zebra (6.4.0-6.4.1)"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["ZcashFoundation"],"content_html":"\u003cp\u003eZcashFoundation Zebra versions 6.4.0 through 6.4.1 contain a denial-of-service vulnerability arising from improper error handling during the processing of specific transaction types. The issue occurs when the node parses a version 6 transaction that carries a pre-NU6.3 consensus branch ID. During the construction of an UnminedTx, the size computation logic assumes that the re-serialization of the Orchard bundle is always successful. If this assumption fails, the application triggers an assertion error, which results in an immediate crash of the zebrad process. Because this message can be sent by unauthenticated peers as a pre-handshake transaction, remote attackers can persistently crash the node by repeatedly sending the malicious payload after every restart, effectively disrupting the availability of the Zebra node on the Zcash network.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows for trivial, persistent denial-of-service attacks against Zebra nodes running vulnerable versions. By sending a single crafted packet, an attacker can crash the node. If the service is automatically restarted by a manager, the attacker can repeat the attack indefinitely, preventing the node from participating in network consensus and processing transactions. This impact is critical for operators of Zebra nodes who rely on consistent uptime for network synchronization and verification.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all instances of ZcashFoundation Zebra to version 6.4.2 or later to include the mandatory error handling fix for Orchard bundle re-serialization.\u003c/li\u003e\n\u003cli\u003eMonitor network logs for a high frequency of incoming 'tx' messages followed immediately by zebrad service termination or restart events.\u003c/li\u003e\n\u003cli\u003ePatch CVE-2026-109363 across all Zebra node infrastructure immediately.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T18:38:22Z","date_published":"2026-10-12T18:38:22Z","id":"https://feed.craftedsignal.io/briefs/2026-10-zebra-dos/","summary":"A vulnerability in ZcashFoundation Zebra 6.4.0 and 6.4.1 allows unauthenticated remote attackers to crash the node by sending a crafted version 6 transaction with a pre-NU6.3 consensus branch ID.","title":"Denial of Service in ZcashFoundation Zebra Node","url":"https://feed.craftedsignal.io/briefs/2026-10-zebra-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Zebra (6.4.0-6.4.1)","version":"https://jsonfeed.org/version/1.1"}