Paper/Archive/CVE-2026-34202

CVE-2026-34202

ZcashFoundation zebra — Zebra node crash — V5 transaction hash panic (P2P reachable)

CVSS 9.2 (CNA)9.2 / 10 × 3027.6 Not in CISA KEV+300.0 EPSS percentile 56.3.563 × 2011.3 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-chain version 6.0.1, a vulnerability in Zebra's transaction processing logic allows a remote, unauthenticated attacker to cause a Zebra node to panic (crash). This is triggered by sending a specially crafted V5 transaction that passes initial deserialization but fails during transaction ID calculation. This issue has been patched in zebrad version 4.3.0 and zebra-chain version 6.0.1.

Affected

ProductAffectedFixed inSource

zebra< 4.3.0–CNA

zebra-chain< 6.0.1–CNA

Scores by source

GitHub_M (CNA)9.2CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refgithub.com/ZcashFoundation/zebra/security/advisories/GHSA-qp6f-w4r3-h8wg refgithub.com/ZcashFoundation/zebra/releases/tag/v4.3.0 refzfnd.org/zebra-4-3-0-critical-security-fixes-zip-235-support-and-performance-improvements