CVE-2026-109365

Executive Summary

CVE-2026-109365 is an uncontrolled resource consumption vulnerability in Zebra, the Zcash node implementation, affecting versions prior to 6.4.0. Unauthenticated network peers can exploit this flaw by supplying forged block bodies that include valid header hashes, forcing the node to perform computationally expensive proof verifications for Sapling, Orchard, and Ironwood shielded pools. The primary impact is a denial of service, specifically stalling block synchronisation for extended periods (up to 67 seconds per crafted block), which can disrupt node availability and network health.

Technical Analysis

Zebra is a Zcash full node implementation written in Rust. The vulnerability resides in the block validation logic, where an attacker can craft a block body that contains a header with a valid hash but a body that has been minimally altered in fields that are not covered by the header hash. Specifically, the NVD description notes that an attacker can "flip authorizing-only bytes such as a coinbase scriptSig," which are not part of the block header and therefore do not invalidate the header hash. This allows the forged block to pass initial header validation checks, triggering full proof verification of the block's shielded transactions.

The core weakness is classified as CWE-345: Insufficient Verification of Data Authenticity. The node fails to adequately verify that the block body corresponds to the claimed header before initiating expensive cryptographic proof verification for Sapling, Orchard, and Ironwood proofs. Because these proof verifications are computationally heavy, an attacker can repeatedly send such malformed blocks, causing the node to waste CPU cycles and stall its synchronisation process. Each crafted block can stall sync for approximately 67 seconds, indicating a significant resource consumption per attempt.

The attack does not require authentication or a valid peer identity, as it leverages the peer-to-peer protocol's block propagation mechanism. The CVSS vector reflects a network-accessible attack with high complexity (likely due to the need to craft valid headers and bodies while remaining within protocol limits) and low availability impact, as the node can recover after the stall, but repeated attacks can lead to prolonged downtime.

No specific function names, code paths, or API endpoints are provided in the NVD description, so the analysis remains at the vulnerability class level. It is worth noting that the CVSS score of 3.7 suggests a relatively low severity, but in context of a blockchain node, even temporary stalls can have ripple effects on network synchronisation and consensus participation.

Exploitation Scenarios

No public proof-of-concept or exploit code is available; the attack chain is inferred from the vulnerability class (uncontrolled resource consumption via forged block bodies) and the NVD description.

1. Reconnaissance/target identification: An attacker scans the network for Zebra nodes running versions prior to 6.4.0. This can be done by probing the Zcash peer-to-peer port (default 8233) and checking version messages exchanged during the handshake. Shodan or similar services can identify exposed nodes.

2. Triggering the flaw: The attacker connects to the target node as a peer. During the normal block propagation process, the attacker sends a crafted block message (e.g., block or inv/getdata sequence) containing a block header with a valid hash and a block body that has been altered in "authorizing-only" fields such as the coinbase scriptSig. These fields are not included in the header hash calculation, so the header hash remains valid.

3. Payload/execution method: The node receives the block and begins validation. Because the header hash is valid, the node proceeds to verify the block's transactions, including Sapling, Orchard, and Ironwood shielded proofs. These verifications are computationally intensive and consume significant CPU resources. The node will process the forged block, wasting resources on proof verification that would ultimately fail if the body were fully validated, but the attacker can repeat this with multiple forged blocks to sustain the resource drain. No specific payload bytes or function calls are described in the NVD, so the exact packet structure is not detailed.

4. Post-exploitation impact: The node experiences repeated stalls in synchronisation, each lasting up to 67 seconds. This delays the node from staying in sync with the chain, potentially causing it to fall behind and become unavailable for queries or mining. Repeated attacks can lead to sustained denial of service, affecting the node operator's ability to participate in the network. There is no confidentiality or integrity impact, as the attacker cannot execute code or alter data beyond the forged block itself.

Impact Assessment

The CVSS score of 3.7 (Low) reflects a network-accessible attack (AV:N) with high complexity (AC:H), no privileges required (PR:N), and no user interaction (UI:N). The scope is unchanged (S:U), with no confidentiality (C:N) or integrity (I:N) impact, and low availability impact (A:L). The low availability impact is due to the temporary nature of the stall per block, but repeated exploitation can accumulate and cause significant downtime.

Affected systems are Zcash nodes running Zebra versions before 6.4.0. The blast radius is limited to the individual node being targeted, but if an attacker targets multiple nodes, the overall Zcash network's resilience could degrade, especially if a large number of nodes are stalled. Businesses relying on Zebra nodes for transaction processing, exchanges, or mining operations may face service interruptions. The lack of authentication means any peer on the network can launch the attack, making it a persistent threat.

Detection Guidance

Sigma Rule

title: Zebra Node Uncontrolled Resource Consumption via Forged Block Bodies
id: 7f8e9a1b-2c3d-4e5f-6a7b-8c9d0e1f2a3b
status: experimental
description: Detects potential exploitation of CVE-2026-109365 by monitoring for excessive block verification failures or resource stalls in Zebra nodes.
logsource:
  product: zebra
  service: node
detection:
  selection:
    EventID: 1001
    Message|contains: 'proof verification failed'
    Duration|gte: 60
  condition: selection
falsepositives:
  - Legitimate high load during initial block download
level: medium
tags:
  - attack.t1499
  - cve.2026.109365

YARA Rule

rule CVE_2026_109365_Zebra_Forged_Block
{
    meta:
        description = "Detects crafted block bodies targeting Zebra proof verification"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "CVE-2026-109365"
        hash = "unknown"
    strings:
        $header_magic = { 0x24 0xE9 0x27 0x64 } // Zcash block header magic (example)
        $coinbase_sig = "coinbase" nocase
        $sapling = "sapling" nocase
        $orchard = "orchard" nocase
        $ironwood = "ironwood" nocase
    condition:
        $header_magic at 0 and any of ($sapling, $orchard, $ironwood)
}

Suricata IDS Rule

alert tcp any any -> any 8233 (msg:"CVE-2026-109365 Zebra Forged Block Body Resource Consumption"; flow:to_server,established; content:"|24 E9 27 64|"; depth:4; content:"coinbase"; nocase; distance:0; within:100; content:"sapling"; nocase; distance:0; within:200; classtype:attempted-dos; sid:1000001; rev:1;)

Elastic Detection

sequence by host.id
  [network where destination.port == 8233 and event.action == "block_received"]
  [process where process.name == "zebra" and event.action == "proof_verification" and event.duration > 60000000000]

Splunk SPL Query

index=zebra_logs sourcetype=zebra:node
| search "proof verification" AND ("sapling" OR "orchard" OR "ironwood")
| where duration > 60
| stats count by src_ip, dest_ip
| where count > 5

Wazuh OSSEC Rule

<group name="zebra,">
  <rule id="100001" level="5">
    <decoded_as>json</decoded_as>
    <field name="message">proof verification</field>
    <field name="duration">\d{2,}</field>
    <description>CVE-2026-109365: Possible Zebra forged block resource exhaustion</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Restrict peer connections to trusted nodes only, using a permissioned network or firewall rules to limit inbound connections on port 8233.
   • Monitor node resource usage and synchronisation status; if stalls are observed, temporarily disconnect from suspicious peers.
   • Consider rate-limiting or disabling automatic block propagation from untrusted peers if the node software allows such configuration (though no specific configuration options are provided in the NVD).

2. Patch/upgrade steps:

   • Upgrade to Zebra version 6.4.0 or later, as the vulnerability description implies that version 6.4.0 contains the fix. No official patch reference or vendor advisory is available in the provided data; operators should monitor the official Zebra repository for updates.
   • Deploy the upgrade during a maintenance window and validate node functionality after restart.

3. Long-term hardening:

   • Implement additional validation checks that ensure block bodies are fully consistent with headers before initiating expensive proof verification, such as verifying the coinbase scriptSig or other authorizing-only fields as part of the header hash or an additional commitment.
   • Adopt a defense-in-depth approach: use redundant nodes with different implementations (e.g., zcashd) to maintain network resilience.
   • Regularly update node software and subscribe to security advisories from the Zcash Foundation and Electric Coin Company.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-109365
• Zebra GitHub repository: https://github.com/ZcashFoundation/zebra (monitor for release 6.4.0)
• Zcash Security Advisories: https://zfnd.org/security/ (check for advisories related to Zebra)
• CWE-345: Insufficient Verification of Data Authenticity: https://cwe.mitre.org/data/definitions/345.html
• MITRE ATT&CK T1499: Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/