CVE-2026-34202: Zebra node crash — V5 transaction hash panic (P2P reachable)
(updated )
A vulnerability in Zebra’s transaction processing logic allows a remote, unauthenticated attacker to cause a Zebra node to panic (crash). This is triggered by sending a specially crafted V5 transaction that passes initial deserialization but fails during transaction ID calculation.
References
- github.com/ZcashFoundation/zebra
- github.com/ZcashFoundation/zebra/releases/tag/v4.3.0
- github.com/ZcashFoundation/zebra/security/advisories/GHSA-qp6f-w4r3-h8wg
- github.com/advisories/GHSA-qp6f-w4r3-h8wg
- nvd.nist.gov/vuln/detail/CVE-2026-34202
- zfnd.org/zebra-4-3-0-critical-security-fixes-zip-235-support-and-performance-improvements
Code Behaviors & Features
Detect and mitigate CVE-2026-34202 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →