CVE-2026-34377

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-consensus version 5.0.1, a logic error in Zebra's transaction verification cache could allow a malicious miner to induce a consensus split. By matching a valid transaction's txid while providing invalid authorization data, a miner could cause vulnerable Zebra nodes to accept an invalid block, leading to a consensus split from the rest of the Zcash network. This would not allow invalid transactions to be accepted but could result in a consensus split between vulnerable Zebra nodes and invulnerable Zebra and Zcashd nodes. This issue has been patched in zebrad version 4.3.0 and zebra-consensus version 5.0.1.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/ZcashFoundation/zebra/releases/tag/v4.3.0	Release Notes
https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-3vmh-33xr-9cqh	Exploit Vendor Advisory
https://zfnd.org/zebra-4-3-0-critical-security-fixes-zip-235-support-and-performance-improvements	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:zfnd:zebra::::::rust::*
	cpe:2.3:a:zfnd:zebra-consensus::::::rust::*

History

No history.

Information

Published : 2026-03-31 15:16

Updated : 2026-07-24 21:10

NVD link : CVE-2026-34377

Mitre link : CVE-2026-34377

CVE.ORG link : CVE-2026-34377

JSON object : View

Products Affected

zfnd

zebra-consensus
zebra

CWE

CWE-347

Improper Verification of Cryptographic Signature

{"id": "CVE-2026-34377", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34377", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-31T17:18:05.262524Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.4, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "ZcashFoundation", "product": "zebra", "versions": [{"status": "affected", "version": "< 4.3.0"}]}, {"vendor": "ZcashFoundation", "product": "zebra-consensus", "versions": [{"status": "affected", "version": "< 5.0.1"}]}]}], "published": "2026-03-31T15:16:19.233", "references": [{"url": "https://github.com/ZcashFoundation/zebra/releases/tag/v4.3.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-3vmh-33xr-9cqh", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://zfnd.org/zebra-4-3-0-critical-security-fixes-zip-235-support-and-performance-improvements", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-347"}]}], "descriptions": [{"lang": "en", "value": "ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-consensus version 5.0.1, a logic error in Zebra's transaction verification cache could allow a malicious miner to induce a consensus split. By matching a valid transaction's txid while providing invalid authorization data, a miner could cause vulnerable Zebra nodes to accept an invalid block, leading to a consensus split from the rest of the Zcash network. This would not allow invalid transactions to be accepted but could result in a consensus split between vulnerable Zebra nodes and invulnerable Zebra and Zcashd nodes. This issue has been patched in zebrad version 4.3.0 and zebra-consensus version 5.0.1."}, {"lang": "es", "value": "ZEBRA es un nodo Zcash escrito completamente en Rust. Antes de la versi\u00f3n 4.3.0 de zebrad y la versi\u00f3n 5.0.1 de zebra-consensus, un error l\u00f3gico en la cach\u00e9 de verificaci\u00f3n de transacciones de Zebra podr\u00eda permitir a un minero malicioso inducir una divisi\u00f3n de consenso. Al hacer coincidir el txid de una transacci\u00f3n v\u00e1lida mientras se proporcionan datos de autorizaci\u00f3n inv\u00e1lidos, un minero podr\u00eda hacer que los nodos Zebra vulnerables aceptaran un bloque inv\u00e1lido, lo que llevar\u00eda a una divisi\u00f3n de consenso del resto de la red Zcash. Esto no permitir\u00eda que se aceptaran transacciones inv\u00e1lidas, pero podr\u00eda resultar en una divisi\u00f3n de consenso entre nodos Zebra vulnerables y nodos Zebra y Zcashd invulnerables. Este problema ha sido parcheado en la versi\u00f3n 4.3.0 de zebrad y la versi\u00f3n 5.0.1 de zebra-consensus."}], "lastModified": "2026-07-24T21:10:00.143", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:zfnd:zebra:*:*:*:*:*:rust:*:*", "vulnerable": true, "matchCriteriaId": "4B93957D-63A6-4232-8046-FDF593752C05", "versionEndExcluding": "4.3.0"}, {"criteria": "cpe:2.3:a:zfnd:zebra-consensus:*:*:*:*:*:rust:*:*", "vulnerable": true, "matchCriteriaId": "D958D1C3-B1F2-48EE-A41C-777DE3C0A8B1", "versionEndExcluding": "5.0.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}