Vulnerability · Published Mar 31, 2026 · Assigned by GitHub_M

CVE-2026-34202Zebra node crash — V5 transaction hash panic (P2P reachable)

Critical 9.2

In plain English

A critical-severity code injection in zebra from ZcashFoundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).

Severity (CVSS 4.0)9.2Critical

Exploit odds (30 days)0.8%top 43.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-chain version 6.0.1, a vulnerability in Zebra's transaction processing logic allows a remote, unauthenticated attacker to cause a Zebra node to panic (crash). This is triggered by sending a specially crafted V5 transaction that passes initial deserialization but fails during transaction ID calculation. This issue has been patched in zebrad version 4.3.0 and zebra-chain version 6.0.1.

Affected products (as reported)

Vendor	Product	Versions
ZcashFoundation	zebra	< 4.3.0
ZcashFoundation	zebra-chain	< 6.0.1

Weakness: CWE-1336, CWE-94 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

References

https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-qp6f-w4r3-h8wg x_refsource_CONFIRM
https://github.com/ZcashFoundation/zebra/releases/tag/v4.3.0 x_refsource_MISC
https://zfnd.org/zebra-4-3-0-critical-security-fixes-zip-235-support-and-performance-improvements x_refsource_MISC