{"id":"CVE-2026-34202","title":"ZEBRA is a Zcash node written entirely in Rust","summary":"ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-chain version 6.0.1, a vulnerability in Zebra's transaction processing logic allows a remote, unauthenticated attacker to cause a Zebra node to panic…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-94","CWE-1336","CWE-502"],"vendor":"zfnd","product":"zebra","affected":["zebra < 4.3.0","zebra-chain < 6.0.1"],"patched":["zebra 4.3.0","zebra-chain 6.0.1"],"published":"2026-03-31","updated":"2026-07-24","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-34202","references":[{"url":"https://github.com/ZcashFoundation/zebra/releases/tag/v4.3.0","label":"security-advisories@github.com"},{"url":"https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-qp6f-w4r3-h8wg","label":"security-advisories@github.com"},{"url":"https://zfnd.org/zebra-4-3-0-critical-security-fixes-zip-235-support-and-performance-improvements","label":"security-advisories@github.com"}],"tags":["nvd"],"epss":0.00725,"epssPercentile":0.52634,"ingestedAt":"2026-07-24T21:39:13.377Z","slug":"CVE-2026-34202","body":"## Overview\n\nZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-chain version 6.0.1, a vulnerability in Zebra's transaction processing logic allows a remote, unauthenticated attacker to cause a Zebra node to panic (crash). This is triggered by sending a specially crafted V5 transaction that passes initial deserialization but fails during transaction ID calculation. This issue has been patched in zebrad version 4.3.0 and zebra-chain version 6.0.1.\n\n## Affected\n\n- `zebra < 4.3.0`\n- `zebra-chain < 6.0.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `zebra 4.3.0`\n- `zebra-chain 6.0.1`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}