Read the docs
TI-2026-26497 Aliases CVE-2026-34202GHSA-qp6f-w4r3-h8wg

Zebra node crash — V5 transaction hash panic (P2P reachable)

Priority MEDIUM 47CWE-1336Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-1336.

Summary

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-chain version 6.0.1, a vulnerability in Zebra's transaction processing logic allows a remote, unauthenticated attacker to cause a Zebra node to panic (crash). This is triggered by sending a specially crafted V5 transaction that passes initial deserialization but fails during transaction ID calculation. This issue has been patched in zebrad version 4.3.0 and zebra-chain version 6.0.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00792 56th percentileScored 2026-11-07
Fix Fixed zebra (ZcashFoundation): 4.3.0zebra-chain (ZcashFoundation): 6.0.1+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ZcashFoundationzebrabefore 4.3.04.3.0Patch availableCNA
ZcashFoundationzebra-chainbefore 6.0.16.0.1Patch availableCNA
—zebrad (crates.io)before 4.3.04.3.0Patch availableGHSA-qp6f-w4r3-h8wg
—zebra-chain (crates.io)before 6.0.16.0.1Patch availableGHSA-qp6f-w4r3-h8wg
  • zebra VendorZcashFoundation Affected before 4.3.0 Fixed in 4.3.0 Patch available CNA
  • zebra-chain VendorZcashFoundation Affected before 6.0.1 Fixed in 6.0.1 Patch available CNA
  • zebrad (crates.io) Vendor— Affected before 4.3.0 Fixed in 4.3.0 Patch available GHSA-qp6f-w4r3-h8wg
  • zebra-chain (crates.io) Vendor— Affected before 6.0.1 Fixed in 6.0.1 Patch available GHSA-qp6f-w4r3-h8wg

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:zfnd:zebra:*:*:*:*:*:rust:*:*before 4.3.0VulnerableZcashFoundation
cpe:2.3:a:zfnd:zebra-chain:*:*:*:*:*:rust:*:*before 6.0.1VulnerableZcashFoundation
  • cpe:2.3:a:zfnd:zebra:*:*:*:*:*:rust:*:* Versions before 4.3.0 Vulnerable ·ZcashFoundation
  • cpe:2.3:a:zfnd:zebra-chain:*:*:*:*:*:rust:*:* Versions before 6.0.1 Vulnerable ·ZcashFoundation

Remediation

  • Fix · CNA zebra (ZcashFoundation) Fixed in 4.3.0
  • Fix · CNA zebra-chain (ZcashFoundation) Fixed in 6.0.1
  • Fix · GHSA-qp6f-w4r3-h8wg zebrad (crates.io) Fixed in 4.3.0 Advisory →
  • Fix · GHSA-qp6f-w4r3-h8wg zebra-chain (crates.io) Fixed in 6.0.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-34202
  2. 2026-10-03 Alias added: GHSA-qp6f-w4r3-h8wg

References

Advisory 3

Other 2

  • TI-2026-26663 Zebra has a Consensus Failure due to Improper Verification of V5 Transactions CVSS 4.0HIGH 8.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences