CVE-2026-34202 Zebra node crash — V5 transaction hash panic (P2P reachable)
Remote attackers can crash Zebra Zcash nodes by sending crafted V5 transactions, requiring an upgrade to patched versions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-34202?
CVE-2026-34202 is a critical denial of service vulnerability in ZcashFoundation zebra, published on 31 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-chain version 6.0.1, a vulnerability in Zebra's transaction processing logic allows a remote, unauthenticated attacker to cause a Zebra node to panic (crash). This is triggered by sending a specially crafted V5 transaction that passes initial deserialization but fails during transaction ID calculation. This issue has been patched in zebrad version 4.3.0 and zebra-chain version 6.0.1.
Which versions are affected by CVE-2026-34202?
4 open source packages ship an affected version, including zebra-chain and zebrad. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
zebra-chain crates.io | All versions | 6.0.1 |
zebra-chain crates.io | All versions | 6.0.1 |
zebrad crates.io | All versions | 4.3.0 |
zebrad crates.io | All versions | 4.3.0 |
Products include Zfnd Zebra, Zfnd Zebra-Chain.
How do I fix CVE-2026-34202?
Upgrade zebra-chain to 6.0.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-34202 being exploited?
There is no known exploitation of CVE-2026-34202 in the wild and no public exploit code.
Other vulnerabilities in ZcashFoundation zebra
Sources
Also known as GHSA-qp6f-w4r3-h8wg.