Zcash Zebra CVE-2026-109363

No special conditions beyond the target running an affected zebrad node (Zebra 6.4.0 up to but not including 6.4.2) with its peer-to-peer network interface reachable by the attacker - exploitation is remote and unauthenticated, and the malicious tx message is accepted pre-handshake, so no peer trust, credentials, or completed connection negotiation is required. The specific trigger is a version-6 transaction encoding a pre-NU6.3 consensus branch ID (e.g., Nu5/Nu6/Nu6.1/Nu6.2 wire branch IDs), which selects an Orchard bundle version the V6 writer cannot re-serialize. Limiting factors are narrow: the flaw affects only the Zebra implementation (not other Zcash nodes), only the 6.4.0-6.4.1 versions, and impact is limited to crashing the node (availability only) with no data exposure or code execution; patched 6.4.2 nodes reject the malformed transaction at parse time.

This is a genuine, actionable availability risk rather than an inflated high-CVSS score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the strongest exploitability profile possible: network-reachable, low complexity, no attack requirements, no privileges, no user interaction - and the description independently corroborates this, stating that unauthenticated peers can send a single pre-handshake tx message to crash zebrad. The impact is confined to availability (VC:N/VI:N/VA:H) - this is a CWE-617 reachable assertion (an infallible-size-computation path that trips an expect and aborts the process), not a memory-corruption or RCE primitive, so there is no confidentiality or integrity exposure. The aggravating factor is repeatability: the node can be re-crashed after each restart, enabling a sustained, trivially automatable DoS loop. Weighing the signals against each other: no EPSS score, no CISA KEV listing, and no public exploit code were provided, so there is no evidence of active or widespread exploitation - the priority here is driven by the ease and reliability of exploitation plus the clear patch availability, not by observed in-the-wild activity. No signals are in conflict; the CVSS vector and the prose description agree on unauthenticated remote reachability. Missing data: EPSS/KEV/POC are all absent (absence is not evidence of low risk for a newly disclosed, easily triggered flaw).

An attacker connects to a target zebrad node's peer-to-peer port and, before completing the handshake, sends a single malformed version-6 transaction carrying a pre-NU6.3 consensus branch ID. During UnminedTx construction the Orchard bundle re-serialization fails, tripping an expect that aborts the process and knocks the node offline; the attacker simply reconnects and resends the message after each automatic restart to maintain the outage. No public exploit code was identified at time of analysis, but the single-packet, no-auth trigger makes weaponization trivial.