CVE-2026-34377 Zebra has a Consensus Failure due to Improper Verification of V5 Transactions

What is CVE-2026-34377?

CVE-2026-34377 is a high-severity vulnerability in ZcashFoundation zebra, published on 31 Mar 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-consensus version 5.0.1, a logic error in Zebra's transaction verification cache could allow a malicious miner to induce a consensus split. By matching a valid transaction's txid while providing invalid authorization data, a miner could cause vulnerable Zebra nodes to accept an invalid block, leading to a consensus split from the rest of the Zcash network. This would not allow invalid transactions to be accepted but could result in a consensus split between vulnerable Zebra nodes and invulnerable Zebra and Zcashd nodes. This issue has been patched in zebrad version 4.3.0 and zebra-consensus version 5.0.1.

Weakness: CWE-347

Which versions are affected by CVE-2026-34377?

4 open source packages ship an affected version, including zebra-consensus and zebrad. It affects 2 products.

Products include Zfnd Zebra, Zfnd Zebra-Consensus.

How do I fix CVE-2026-34377?

Upgrade zebra-consensus to 5.0.1 or later.

Is CVE-2026-34377 being exploited?

There is no known exploitation of CVE-2026-34377 in the wild and no public exploit code.

Other vulnerabilities in ZcashFoundation zebra

• CVE-2026-34202 Zebra node crash — V5 transaction hash panic (P2P reachable) Critical 9.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3vmh-33xr-9cqh.