CVE-2026-34202

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-chain version 6.0.1, a vulnerability in Zebra's transaction processing logic allows a remote, unauthenticated attacker to cause a Zebra node to panic (crash). This is triggered by sending a specially crafted V5 transaction that passes initial deserialization but fails during transaction ID calculation. This issue has been patched in zebrad version 4.3.0 and zebra-chain version 6.0.1.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/ZcashFoundation/zebra/releases/tag/v4.3.0	Release Notes
https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-qp6f-w4r3-h8wg	Vendor Advisory
https://zfnd.org/zebra-4-3-0-critical-security-fixes-zip-235-support-and-performance-improvements	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:zfnd:zebra::::::rust::*
	cpe:2.3:a:zfnd:zebra-chain::::::rust::*

History

No history.

Information

Published : 2026-03-31 15:16

Updated : 2026-07-24 21:10

NVD link : CVE-2026-34202

Mitre link : CVE-2026-34202

CVE.ORG link : CVE-2026-34202

JSON object : View

Products Affected

zfnd

zebra
zebra-chain

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

CWE-1336

Improper Neutralization of Special Elements Used in a Template Engine

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2026-34202", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34202", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-31T17:16:55.754237Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "ZcashFoundation", "product": "zebra", "versions": [{"status": "affected", "version": "< 4.3.0"}]}, {"vendor": "ZcashFoundation", "product": "zebra-chain", "versions": [{"status": "affected", "version": "< 6.0.1"}]}]}], "published": "2026-03-31T15:16:17.860", "references": [{"url": "https://github.com/ZcashFoundation/zebra/releases/tag/v4.3.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-qp6f-w4r3-h8wg", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://zfnd.org/zebra-4-3-0-critical-security-fixes-zip-235-support-and-performance-improvements", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-94"}, {"lang": "en", "value": "CWE-1336"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-chain version 6.0.1, a vulnerability in Zebra's transaction processing logic allows a remote, unauthenticated attacker to cause a Zebra node to panic (crash). This is triggered by sending a specially crafted V5 transaction that passes initial deserialization but fails during transaction ID calculation. This issue has been patched in zebrad version 4.3.0 and zebra-chain version 6.0.1."}, {"lang": "es", "value": "ZEBRA es un nodo Zcash escrito completamente en Rust. Antes de la versi\u00f3n 4.3.0 de zebrad y la versi\u00f3n 6.0.1 de zebra-chain, una vulnerabilidad en la l\u00f3gica de procesamiento de transacciones de Zebra permite a un atacante remoto y no autenticado provocar que un nodo Zebra entre en p\u00e1nico (falle). Esto se activa al enviar una transacci\u00f3n V5 especialmente dise\u00f1ada que pasa la deserializaci\u00f3n inicial pero falla durante el c\u00e1lculo del ID de la transacci\u00f3n. Este problema ha sido parcheado en la versi\u00f3n 4.3.0 de zebrad y la versi\u00f3n 6.0.1 de zebra-chain."}], "lastModified": "2026-07-24T21:10:00.143", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:zfnd:zebra:*:*:*:*:*:rust:*:*", "vulnerable": true, "matchCriteriaId": "4B93957D-63A6-4232-8046-FDF593752C05", "versionEndExcluding": "4.3.0"}, {"criteria": "cpe:2.3:a:zfnd:zebra-chain:*:*:*:*:*:rust:*:*", "vulnerable": true, "matchCriteriaId": "5B11D020-A19F-4A46-B359-7325300738F2", "versionEndExcluding": "6.0.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}