CVE-2026-34377: Zebra has a Consensus Failure due to Improper Verification of V5 Transactions
(updated )
A logic error in Zebra’s transaction verification cache could allow a malicious miner to induce a consensus split. By matching a valid transaction’s txid while providing invalid authorization data, a miner could cause vulnerable Zebra nodes to accept an invalid block, leading to a consensus split from the rest of the Zcash network. To be clear, this would not allow invalid transactions to be accepted but could result in a consensus split between vulnerable Zebra nodes and invulnerable Zebra and Zcashd nodes.
References
- github.com/ZcashFoundation/zebra
- github.com/ZcashFoundation/zebra/releases/tag/v4.3.0
- github.com/ZcashFoundation/zebra/security/advisories/GHSA-3vmh-33xr-9cqh
- github.com/advisories/GHSA-3vmh-33xr-9cqh
- nvd.nist.gov/vuln/detail/CVE-2026-34377
- zfnd.org/zebra-4-3-0-critical-security-fixes-zip-235-support-and-performance-improvements
- zips.z.cash/zip-0244
Code Behaviors & Features
Detect and mitigate CVE-2026-34377 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →