Zebra CVE-2026-109366

The attacker must be an unauthenticated inbound gossip peer (PR:N) and must obtain a genuine, freshly-mined block and rewrite its coinbase scriptSig to encode height 1 while keeping the valid ZIP-244 block hash, then deliver it during the block-propagation window - the CVSS AT:P reflects this timing-and-crafting requirement. Exploitation is LIMITED to Zebra versions before 6.4.0 and its effect is bounded to availability (VA:L): it delays tip discovery for mining backends and forces no-penalty dropping of new blocks, with no code execution, no data disclosure, and no scope change to other systems.

The provided CVSS 4.0 vector (6.3, Medium) describes a network-reachable (AV:N), low-complexity (AC:L), unauthenticated (PR:N) flaw requiring no user interaction (UI:N) but carrying an Attack Requirement (AT:P), indicating exploitation depends on specific conditions such as serving the forged block within the block-propagation window. The only impact is Low availability on the vulnerable system (VA:L); confidentiality and integrity impacts are explicitly N, and there is no scope change (SC/SI/SA:N). No EPSS score, CISA KEV listing, POC, or SSVC decision data was supplied, so exploitation-probability and automatability cannot be quantified - absence of these is not evidence of safety but limits confidence. This is realistically a targeted availability/consensus-disruption issue (delayed tip discovery for mining backends), not a high-impact RCE or data-exposure bug, so it is a moderate, mining-operator-specific concern rather than a broad emergency priority. CONFLICT TO NOTE: the input Tag 'Information Disclosure' directly contradicts the CVSS vector (VC:N - no confidentiality impact); the actual effect is availability/integrity-of-chain-state, so the tag appears mislabeled and should not drive triage.

A malicious node peers with a Zebra instance over the normal gossip protocol and serves a genuine, recently-mined block whose coinbase scriptSig has been rewritten to encode height 1 while preserving the valid ZIP-244 block hash. Zebra treats the block as behind-tip and drops it before consensus validation, so the node and any mining backends relying on it experience delayed tip discovery. No public exploit identified at time of analysis; the attack requires timing the forged block to the propagation window (reflected by AT:P).