CVE-2026-109363 ZcashFoundation CVE debrief

Who should care

Defenders responsible for ZcashFoundation Zebra software deployments should assess exposure and prioritize patching to prevent DoS attacks. Operators of Zebra software should verify the version and apply the patch to prevent DoS attacks. Security teams should review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-109363 is a high-severity vulnerability in ZcashFoundation's Zebra software versions 6.4.0 before 6.4.2. Defenders should prioritize verifying the Zebra version and applying the patch to prevent DoS attacks.

• Potential DoS attacks against ZcashFoundation Zebra software deployments
• Unauthenticated peers can cause node crashes
• Repeated attacks possible after each restart

Technical summary

The ZcashFoundation Zebra software versions 6.4.0 before 6.4.2 are vulnerable to a denial-of-service (DoS) attack via a malformed v6 transaction. An unauthenticated peer can send a single malformed transaction to crash the node, which can be repeated after each restart. The vulnerability is caused by the Zebra software's incorrect handling of version 6 transactions with a pre-NU6.3 consensus branch ID. The software's UnminedTx construction treats re-serialization of the Orchard bundle as infallible, leading to an expect that aborts zebrad when an error occurs.

Defensive priority

Defenders should prioritize verifying the Zebra version and applying the patch to prevent DoS attacks.

Recommended defensive actions

• Verify the Zebra version and apply the patch to prevent DoS attacks
• Monitor for suspicious v6 transaction activity
• Implement network segmentation to limit the impact of a potential DoS attack
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by the Zebra software's incorrect handling of version 6 transactions with a pre-NU6.3 consensus branch ID. The software's UnminedTx construction treats re-serialization of the Orchard bundle as infallible, leading to an expect that aborts zebrad when an error occurs.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.