Zcash Zebra CVE-2026-109365

Exploitation requires the attacker to be a connected network peer that the target Zebra node (any version before 6.4.0) accepts block data from during synchronization - no authentication is required (PR:N). The attacker must craft block bodies that carry a valid block-header hash while mutating authorizing-only bytes such as the coinbase scriptSig, tricking the node into running full Sapling, Orchard, and Ironwood proof verification against forgeable content. Limiting factors: impact is a temporary ~67-second sync stall rather than a persistent crash or data compromise, the node must be in a syncing state and peered with the attacker, and there is no confidentiality or integrity exposure.

This is a moderate-severity availability issue, not a high-priority emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) confirms a network-reachable, unauthenticated, low-complexity attack, but the only impact is VA:L (partial/temporary availability degradation) with no confidentiality or integrity impact - consistent with the description's transient 67-second sync stall rather than a persistent crash or node takeover. The AT:P (attack requirement 'Present') reflects that the attacker must be a connected peer feeding the node forged block bodies during sync, a real but non-trivial precondition that tempers the otherwise-open network vector. No EPSS score, CISA KEV listing, or SSVC decision data was provided, and no public exploit identified at time of analysis, so there is no signal of active or widespread exploitation; this reads as a theoretical resource-exhaustion bug responsibly reported by VulnCheck/Zcash Foundation rather than an exploited-in-the-wild threat. Note a data conflict: the input Tags label this 'Information Disclosure,' which contradicts the CWE-345 classification, the description's uncontrolled-resource-consumption wording, and the referenced VulnCheck advisory URL explicitly naming it denial-of-service - the availability-only CVSS impact confirms this is a DoS, not information disclosure.

A malicious peer connects to a victim Zebra node during block synchronization and serves forged block bodies whose header hashes are valid but whose authorizing-only bytes (e.g., the coinbase scriptSig) have been flipped. This forces the node to perform full, expensive Sapling, Orchard, and Ironwood zero-knowledge proof verification on data the attacker can trivially mutate, stalling sync for roughly 67 seconds per attack with no penalty to the peer. No public exploit code was identified in the provided data.