CVE-2026-34202 json
Zebra node crash — V5 transaction hash panic (P2P reachable)
published 2026-03-27 7 mo ago modified 2026-07-24 3 mo ago also EUVD-2026-17453 , GHSA-qp6f-w4r3-h8wg
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 56%
- public exploits
- 0
- none known
Summary
ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-chain version 6.0.1, a vulnerability in Zebra's transaction processing logic allows a remote, unauthenticated attacker to cause a Zebra node to panic (crash). This is triggered by sending a specially crafted V5 transaction that passes initial deserialization but fails during transaction ID calculation. This issue has been patched in zebrad version 4.3.0 and zebra-chain version 6.0.1.
Patch / fix
- crates.io zebrad 4.3.0
- crates.io zebra-chain 6.0.1
- zfnd zebra 4.3.0
- zfnd zebrad 4.3.0
- zfnd zebra-chain 6.0.1
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 7 mo ago
Exploit prediction
0.79% chance of exploitation in the next 30 days, higher than 56% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 9.2 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H |
| CNA | 4.0 | 9.2 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | zebrad | <4.3.0 |
4.3.0 |
| crates.io | zebra-chain | <6.0.1 |
6.0.1 |
Affected products
- ZcashFoundation zebra
- ZcashFoundation zebra-chain
Classification
References
-
github.com
/ZcashFoundation/zebra/security/advisories/GHSA-qp6f-w4r3-h8wg
web, vendor-advisory
-
zfnd.org
/zebra-4-3-0-critical-security-fixes-zip-235-support-and-performance-improvements
web, vendor-advisory
-
github.com
/ZcashFoundation/zebra/releases/tag/v4.3.0
web, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2026-34202
advisory
-
github.com
/ZcashFoundation/zebra
package
Sources
- CVE List CVE-2026-34202
- GitHub Advisory GHSA-qp6f-w4r3-h8wg
- NVD CVE-2026-34202
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.