{"id":"CVE-2026-34377","title":"ZEBRA is a Zcash node written entirely in Rust","summary":"ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-consensus version 5.0.1, a logic error in Zebra's transaction verification cache could allow a malicious miner to induce a consensus split. By matchi…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","cwe":["CWE-347"],"vendor":"zfnd","product":"zebra","affected":["zebra < 4.3.0","zebra-consensus < 5.0.1"],"patched":["zebra 4.3.0","zebra-consensus 5.0.1"],"published":"2026-03-31","updated":"2026-07-24","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-34377","references":[{"url":"https://github.com/ZcashFoundation/zebra/releases/tag/v4.3.0","label":"security-advisories@github.com"},{"url":"https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-3vmh-33xr-9cqh","label":"security-advisories@github.com"},{"url":"https://zfnd.org/zebra-4-3-0-critical-security-fixes-zip-235-support-and-performance-improvements","label":"security-advisories@github.com"}],"tags":["nvd"],"epss":0.00255,"epssPercentile":0.17467,"ingestedAt":"2026-07-24T21:39:13.550Z","slug":"CVE-2026-34377","body":"## Overview\n\nZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-consensus version 5.0.1, a logic error in Zebra's transaction verification cache could allow a malicious miner to induce a consensus split. By matching a valid transaction's txid while providing invalid authorization data, a miner could cause vulnerable Zebra nodes to accept an invalid block, leading to a consensus split from the rest of the Zcash network. This would not allow invalid transactions to be accepted but could result in a consensus split between vulnerable Zebra nodes and invulnerable Zebra and Zcashd nodes. This issue has been patched in zebrad version 4.3.0 and zebra-consensus version 5.0.1.\n\n## Affected\n\n- `zebra < 4.3.0`\n- `zebra-consensus < 5.0.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `zebra 4.3.0`\n- `zebra-consensus 5.0.1`","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}