CVE-2026-34202

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-34202", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-26T15:57:52.323Z", "datePublished": "2026-03-31T14:02:56.454Z", "dateUpdated": "2026-03-31T17:17:30.860Z"}, "containers": {"cna": {"title": "Zebra node crash \u2014 V5 transaction hash panic (P2P reachable)", "problemTypes": [{"descriptions": [{"cweId": "CWE-1336", "lang": "en", "description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "HIGH", "baseScore": 9.2, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H", "version": "4.0"}}], "references": [{"name": "https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-qp6f-w4r3-h8wg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-qp6f-w4r3-h8wg"}, {"name": "https://github.com/ZcashFoundation/zebra/releases/tag/v4.3.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/ZcashFoundation/zebra/releases/tag/v4.3.0"}, {"name": "https://zfnd.org/zebra-4-3-0-critical-security-fixes-zip-235-support-and-performance-improvements", "tags": ["x_refsource_MISC"], "url": "https://zfnd.org/zebra-4-3-0-critical-security-fixes-zip-235-support-and-performance-improvements"}], "affected": [{"vendor": "ZcashFoundation", "product": "zebra", "versions": [{"version": "< 4.3.0", "status": "affected"}]}, {"vendor": "ZcashFoundation", "product": "zebra-chain", "versions": [{"version": "< 6.0.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-31T14:02:56.454Z"}, "descriptions": [{"lang": "en", "value": "ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-chain version 6.0.1, a vulnerability in Zebra's transaction processing logic allows a remote, unauthenticated attacker to cause a Zebra node to panic (crash). This is triggered by sending a specially crafted V5 transaction that passes initial deserialization but fails during transaction ID calculation. This issue has been patched in zebrad version 4.3.0 and zebra-chain version 6.0.1."}], "source": {"advisory": "GHSA-qp6f-w4r3-h8wg", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-31T17:16:55.754237Z", "id": "CVE-2026-34202", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-31T17:17:30.860Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-34202", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-31T17:16:55.754237Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-31T17:17:26.784Z"}}], "cna": {"title": "Zebra node crash \u2014 V5 transaction hash panic (P2P reachable)", "source": {"advisory": "GHSA-qp6f-w4r3-h8wg", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 9.2, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "ZcashFoundation", "product": "zebra", "versions": [{"status": "affected", "version": "< 4.3.0"}]}, {"vendor": "ZcashFoundation", "product": "zebra-chain", "versions": [{"status": "affected", "version": "< 6.0.1"}]}], "references": [{"url": "https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-qp6f-w4r3-h8wg", "name": "https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-qp6f-w4r3-h8wg", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/ZcashFoundation/zebra/releases/tag/v4.3.0", "name": "https://github.com/ZcashFoundation/zebra/releases/tag/v4.3.0", "tags": ["x_refsource_MISC"]}, {"url": "https://zfnd.org/zebra-4-3-0-critical-security-fixes-zip-235-support-and-performance-improvements", "name": "https://zfnd.org/zebra-4-3-0-critical-security-fixes-zip-235-support-and-performance-improvements", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-chain version 6.0.1, a vulnerability in Zebra's transaction processing logic allows a remote, unauthenticated attacker to cause a Zebra node to panic (crash). This is triggered by sending a specially crafted V5 transaction that passes initial deserialization but fails during transaction ID calculation. This issue has been patched in zebrad version 4.3.0 and zebra-chain version 6.0.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1336", "description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-31T14:02:56.454Z"}}}, "cveMetadata": {"cveId": "CVE-2026-34202", "state": "PUBLISHED", "dateUpdated": "2026-03-31T17:17:30.860Z", "dateReserved": "2026-03-26T15:57:52.323Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-31T14:02:56.454Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "zebra", "vendor": "ZcashFoundation", "versions": [{"status": "affected", "version": "< 4.3.0"}]}, {"product": "zebra-chain", "vendor": "ZcashFoundation", "versions": [{"status": "affected", "version": "< 6.0.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:zfnd:zebra:*:*:*:*:*:rust:*:*", "matchCriteriaId": "4B93957D-63A6-4232-8046-FDF593752C05", "versionEndExcluding": "4.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zfnd:zebra-chain:*:*:*:*:*:rust:*:*", "matchCriteriaId": "5B11D020-A19F-4A46-B359-7325300738F2", "versionEndExcluding": "6.0.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-chain version 6.0.1, a vulnerability in Zebra's transaction processing logic allows a remote, unauthenticated attacker to cause a Zebra node to panic (crash). This is triggered by sending a specially crafted V5 transaction that passes initial deserialization but fails during transaction ID calculation. This issue has been patched in zebrad version 4.3.0 and zebra-chain version 6.0.1."}, {"lang": "es", "value": "ZEBRA es un nodo Zcash escrito completamente en Rust. Antes de la versi\u00f3n 4.3.0 de zebrad y la versi\u00f3n 6.0.1 de zebra-chain, una vulnerabilidad en la l\u00f3gica de procesamiento de transacciones de Zebra permite a un atacante remoto y no autenticado provocar que un nodo Zebra entre en p\u00e1nico (falle). Esto se activa al enviar una transacci\u00f3n V5 especialmente dise\u00f1ada que pasa la deserializaci\u00f3n inicial pero falla durante el c\u00e1lculo del ID de la transacci\u00f3n. Este problema ha sido parcheado en la versi\u00f3n 4.3.0 de zebrad y la versi\u00f3n 6.0.1 de zebra-chain."}], "id": "CVE-2026-34202", "lastModified": "2026-07-24T21:10:00.143", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.2, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34202", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-31T17:16:55.754237Z", "version": "2.0.3"}}]}, "published": "2026-03-31T15:16:17.860", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/ZcashFoundation/zebra/releases/tag/v4.3.0"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-qp6f-w4r3-h8wg"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://zfnd.org/zebra-4-3-0-critical-security-fixes-zip-235-support-and-performance-improvements"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}, {"lang": "en", "value": "CWE-1336"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-502"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.3.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "zebra", "source": "cna", "vendor": "ZcashFoundation"}, "product": "zebra", "vendor": "zcashfoundation"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.0.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "zebra-chain", "source": "cna", "vendor": "ZcashFoundation"}, "product": "zebra-chain", "vendor": "zcashfoundation"}], "analysis": {"en": {"generated_at": "2026-04-07T23:39:45.613288+00:00", "value": {"mitigation_remediation": ["Apply the zebra v4.3.0 or zebra-chain v6.0.1 update and restart the node"], "summary": {"action": "Immediate patch", "impact": "Node crash causing denial of service"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Zcash Foundation\u2019s Zebra node and Zebra-chain software versions prior to zebrad 4.3.0 and zebra-chain 6.0.1. Only these older releases are impacted; newer releases incorporate the fix.", "description_and_impact": "A remote unauthenticated attacker can crash a Zebra node by sending a specially crafted V5 transaction that passes initial deserialization but fails during transaction ID calculation, forcing a panic in the transaction processing logic. This results in a denial of service, disrupting the node\u2019s availability for a participant in the Zcash network.", "risk_and_exploitability": "The CVSS score of 9.2 indicates high severity, while the EPSS score of less than 1% suggests a low probability of widespread exploitation. The issue is not listed in the CISA KEV catalog. The attack vector is P2P reachable, meaning a remote attacker can trigger the crash by sending the crafted transaction over the network, without any authentication."}}}}, "created": "2026-03-31T19:54:35.988050+00:00", "updated": "2026-04-08T20:00:20.435595+00:00", "vendors": ["zcashfoundation", "zcashfoundation$PRODUCT$zebra", "zcashfoundation$PRODUCT$zebra-chain"]}