CVE-2026-34202
High
Description
ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-chain version 6.0.1, a vulnerability in Zebra's transaction processing logic allows a remote, unauthenticated attacker to cause a Zebra node to panic (crash). This is triggered by sending a specially crafted V5 transaction that passes initial deserialization but fails during transaction ID calculation. This issue has been patched in zebrad version 4.3.0 and zebra-chain version 6.0.1.
SeverityHigh
CVSS7.5
Exploit probability—
ProductZfnd Zebra
PublishedMar 31, 2026
First seenMar 31, 2026
Weakness typeCWE-1336CWE-1336CWE-94Code injection
How to fix
Update
- zfnd zebra4.3.0 or later
- zfnd zebra-chain6.0.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zfnd zebra | v < 4.3.0 | 4.3.0 |
| zfnd zebra-chain | v < 6.0.1 | 6.0.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.