[ CVE-2026-109363 · Published 12 Oct 2026 ]
Vulnerability in ZcashFoundation zebra
CVSS 7.5
EPSS <1%No fix listed yet
[ Description ]Official description
ZcashFoundation Zebra 6.4.0 before 6.4.2 parses version 6 transactions carrying a pre-NU6.3 consensus branch ID, but the size computation during UnminedTx construction treats re-serialization of the Orchard bundle as infallible, so the resulting error trips an expect that aborts zebrad. Unauthenticated peers can send a single pre-handshake tx message to crash the node, and can repeat this after each restart.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.