CVE-2026-104422

Summary

Zebra nodes are vulnerable to a denial-of-service attack where malicious peers can delay block synchronization by manipulating the coinbase scriptSig to claim false block heights. This allows attackers to keep nodes from discovering the newest blocks, effectively stalling the blockchain sync process.

Exploitability

Exploitation is relatively straightforward as it requires only a malicious peer to serve blocks with false coinbase heights, but it needs the attacker to control at least one peer in the network that can feed blocks to the vulnerable node.

Blast radius

The impact could be significant for full nodes that rely on accurate block height information for synchronization, potentially causing them to stall or delay processing of new blocks for extended periods.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Zebra version 6.3.0 or later to fix the coinbase scriptSig validation issue.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.