CVE-2026-104422

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-104422
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104422.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-104422
Aliases
  • GHSA-g95h-hw6g-pvgv
Published
2026-10-02T11:38:03Z
Modified
2026-10-04T02:45:46Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Zebra before 6.3.0 Block Sync Denial of Service via Coinbase scriptSig Rewrite
Details

The block sync download path in Zebra (zebrad) before 6.3.0 reads a block's height from its unvalidated coinbase scriptSig and drops blocks that appear too far behind the tip before consensus validation, without penalizing the supplying peer. Because V5 transaction IDs exclude the scriptSig, a malicious peer can repeatedly serve a canonical block whose coinbase claims height 1 while keeping the requested hash, delaying the node's discovery of the newest block.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-345"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104422.json"
}
References

Affected packages

Git / github.com/zcashfoundation/zebra

Affected ranges

Type
GIT
Repo
https://github.com/zcashfoundation/zebra
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f5c5277fe41eba9c74f37098738f93f35dd70d60
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "6.3.0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

4.*
4.3.1
tower-batch-control-v1.*
tower-batch-control-v1.1.0
tower-batch-control-v1.1.1
tower-fallback-v0.*
tower-fallback-v0.2.42
tower-fallback-v0.2.43
v1.*
v1.0.0
v1.0.0-alpha.0
v1.0.0-alpha.1
v1.0.0-alpha.10
v1.0.0-alpha.11
v1.0.0-alpha.12
v1.0.0-alpha.13
v1.0.0-alpha.14
v1.0.0-alpha.15
v1.0.0-alpha.16
v1.0.0-alpha.17
v1.0.0-alpha.18
v1.0.0-alpha.19
v1.0.0-alpha.2
v1.0.0-alpha.3
v1.0.0-alpha.4
v1.0.0-alpha.5
v1.0.0-alpha.6
v1.0.0-alpha.7
v1.0.0-alpha.8
v1.0.0-alpha.9
v1.0.0-beta.0
v1.0.0-beta.1
v1.0.0-beta.10
v1.0.0-beta.11
v1.0.0-beta.12
v1.0.0-beta.13
v1.0.0-beta.14
v1.0.0-beta.15
v1.0.0-beta.2
v1.0.0-beta.3
v1.0.0-beta.4
v1.0.0-beta.5
v1.0.0-beta.6
v1.0.0-beta.7
v1.0.0-beta.8
v1.0.0-beta.9
v1.0.0-rc.0
v1.0.0-rc.1
v1.0.0-rc.2
v1.0.0-rc.3
v1.0.0-rc.4
v1.0.0-rc.5
v1.0.0-rc.6
v1.0.0-rc.7
v1.0.0-rc.8
v1.0.0-rc.9
v1.0.1
v1.1.0
v1.2.0
v1.3.0
v1.4.0
v1.5.0
v1.5.1
v1.5.2
v1.6.0
v1.6.1
v1.7.0
v1.8.0
v1.9.0
v2.*
v2.0.0
v2.0.0-rc.0
v2.0.1
v2.1.0
v2.2.0
v2.3.0
v2.4.0
v2.4.2
v2.5.0
v3.*
v3.0.0
v3.0.0-rc.0
v3.1.0
v4.*
v4.0.0
v4.1.0
v4.2.0
v4.3.0
v4.3.1
v4.4.0
v4.4.1
v4.5.0
v4.5.1
v5.*
v5.0.0
v5.1.0
v5.1.1
v5.2.0
v6.*
v6.0.0
v6.0.0-rc.0
v6.1.0
v6.2.0
v6.2.1
v6.2.2
v6.2.3
zebra-chain-v11.*
zebra-chain-v11.1.0
zebra-chain-v11.2.0
zebra-chain-v11.3.0
zebra-consensus-v11.*
zebra-consensus-v11.0.0
zebra-consensus-v12.*
zebra-consensus-v12.0.0
zebra-consensus-v12.0.1
zebra-consensus-v13.*
zebra-consensus-v13.0.0
zebra-consensus-v14.*
zebra-consensus-v14.0.0
zebra-consensus-v14.0.1
zebra-network-v10.*
zebra-network-v10.1.0
zebra-network-v10.1.1
zebra-network-v10.2.0
zebra-network-v10.2.1
zebra-network-v11.*
zebra-network-v11.0.0
zebra-node-services-v9.*
zebra-node-services-v9.1.0
zebra-node-services-v9.1.1
zebra-node-services-v9.1.2
zebra-rpc-v11.*
zebra-rpc-v11.1.0
zebra-rpc-v12.*
zebra-rpc-v12.0.0
zebra-rpc-v13.*
zebra-rpc-v13.0.0
zebra-rpc-v14.*
zebra-rpc-v14.0.0
zebra-rpc-v15.*
zebra-rpc-v15.0.0
zebra-script-v10.*
zebra-script-v10.1.0
zebra-script-v10.1.1
zebra-script-v10.1.2
zebra-state-v10.*
zebra-state-v10.1.0
zebra-state-v11.*
zebra-state-v11.0.0
zebra-state-v11.1.0
zebra-state-v11.1.1
zebra-state-v12.*
zebra-state-v12.0.0
zebra-state-v12.0.1
zebra-utils-v10.*
zebra-utils-v10.0.0
zebra-utils-v9.*
zebra-utils-v9.1.0
zebra-utils-v9.1.1
zebra-utils-v9.1.3
zebra-utils-v9.1.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104422.json"