CVE-2026-34202 Details
Description
ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-chain version 6.0.1, a vulnerability in Zebra's transaction processing logic allows a remote, unauthenticated attacker to cause a Zebra node to panic (crash). This is triggered by sending a specially crafted V5 transaction that passes initial deserialization but fails during transaction ID calculation. This issue has been patched in zebrad version 4.3.0 and zebra-chain version 6.0.1.
A remote denial-of-service vulnerability has been identified in Zcash Zebra nodes, specifically in versions prior to 4.3.0 for zebrad and prior to 6.0.1 for zebra-chain. The issue arises in the transaction processing logic, where a remote, unauthenticated attacker can cause a Zebra node to crash. This is achieved by sending a specially crafted V5 transaction that successfully passes initial deserialization but fails during the calculation of the transaction ID, leading to a panic and crash of the node.
Users are advised to upgrade to Zebra version 4.3.0 or later. If an immediate upgrade is not possible, ensure that the RPC port is not exposed to the Internet. The P2P port should remain closed or restricted to trusted peers to fully mitigate the risk.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | [email protected] |
| CWE-1336 | Improper Neutralization of Special Elements Used in a Template Engine | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| zfnd zebra | < 4.3.0 |
CPE
Remediation
| |
| zfnd zebra-chain | < 6.0.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 7, 2026 | Initial Analysis | [email protected] |
| Mar 31, 2026 | New CVE Received | [email protected] |