CVE-2026-34377 (GCVE-0-2026-34377)

Vulnerability from cvelistv5 – Published: 2026-03-31 14:05 – Updated: 2026-03-31 17:18

Title

Zebra has a Consensus Failure due to Improper Verification of V5 Transactions

Summary

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-consensus version 5.0.1, a logic error in Zebra's transaction verification cache could allow a malicious miner to induce a consensus split. By matching a valid transaction's txid while providing invalid authorization data, a miner could cause vulnerable Zebra nodes to accept an invalid block, leading to a consensus split from the rest of the Zcash network. This would not allow invalid transactions to be accepted but could result in a consensus split between vulnerable Zebra nodes and invulnerable Zebra and Zcashd nodes. This issue has been patched in zebrad version 4.3.0 and zebra-consensus version 5.0.1.

Severity

8.4 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-347 - Improper Verification of Cryptographic Signature

Assigner

GitHub_M

References

3 references

URL	Tags
https://github.com/ZcashFoundation/zebra/security…	x_refsource_CONFIRM
https://github.com/ZcashFoundation/zebra/releases…	x_refsource_MISC
https://zfnd.org/zebra-4-3-0-critical-security-fi…	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version
ZcashFoundation	zebra	Affected: < 4.3.0
ZcashFoundation	zebra-consensus	Affected: < 5.0.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-34377",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-31T17:18:05.262524Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-31T17:18:12.932Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "zebra",
          "vendor": "ZcashFoundation",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.3.0"
            }
          ]
        },
        {
          "product": "zebra-consensus",
          "vendor": "ZcashFoundation",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-consensus version 5.0.1, a logic error in Zebra\u0027s transaction verification cache could allow a malicious miner to induce a consensus split. By matching a valid transaction\u0027s txid while providing invalid authorization data, a miner could cause vulnerable Zebra nodes to accept an invalid block, leading to a consensus split from the rest of the Zcash network. This would not allow invalid transactions to be accepted but could result in a consensus split between vulnerable Zebra nodes and invulnerable Zebra and Zcashd nodes. This issue has been patched in zebrad version 4.3.0 and zebra-consensus version 5.0.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "privilegesRequired": "HIGH",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-347",
              "description": "CWE-347: Improper Verification of Cryptographic Signature",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-31T14:05:59.959Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-3vmh-33xr-9cqh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-3vmh-33xr-9cqh"
        },
        {
          "name": "https://github.com/ZcashFoundation/zebra/releases/tag/v4.3.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ZcashFoundation/zebra/releases/tag/v4.3.0"
        },
        {
          "name": "https://zfnd.org/zebra-4-3-0-critical-security-fixes-zip-235-support-and-performance-improvements",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://zfnd.org/zebra-4-3-0-critical-security-fixes-zip-235-support-and-performance-improvements"
        }
      ],
      "source": {
        "advisory": "GHSA-3vmh-33xr-9cqh",
        "discovery": "UNKNOWN"
      },
      "title": "Zebra has a Consensus Failure due to Improper Verification of V5 Transactions"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-34377",
    "datePublished": "2026-03-31T14:05:59.959Z",
    "dateReserved": "2026-03-27T13:43:14.370Z",
    "dateUpdated": "2026-03-31T17:18:12.932Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-34377",
      "date": "2026-08-03",
      "epss": "0.00255",
      "percentile": "0.17147"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-34377\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-03-31T15:16:19.233\",\"lastModified\":\"2026-07-24T21:10:00.143\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-consensus version 5.0.1, a logic error in Zebra\u0027s transaction verification cache could allow a malicious miner to induce a consensus split. By matching a valid transaction\u0027s txid while providing invalid authorization data, a miner could cause vulnerable Zebra nodes to accept an invalid block, leading to a consensus split from the rest of the Zcash network. This would not allow invalid transactions to be accepted but could result in a consensus split between vulnerable Zebra nodes and invulnerable Zebra and Zcashd nodes. This issue has been patched in zebrad version 4.3.0 and zebra-consensus version 5.0.1.\"},{\"lang\":\"es\",\"value\":\"ZEBRA es un nodo Zcash escrito completamente en Rust. Antes de la versi\u00f3n 4.3.0 de zebrad y la versi\u00f3n 5.0.1 de zebra-consensus, un error l\u00f3gico en la cach\u00e9 de verificaci\u00f3n de transacciones de Zebra podr\u00eda permitir a un minero malicioso inducir una divisi\u00f3n de consenso. Al hacer coincidir el txid de una transacci\u00f3n v\u00e1lida mientras se proporcionan datos de autorizaci\u00f3n inv\u00e1lidos, un minero podr\u00eda hacer que los nodos Zebra vulnerables aceptaran un bloque inv\u00e1lido, lo que llevar\u00eda a una divisi\u00f3n de consenso del resto de la red Zcash. Esto no permitir\u00eda que se aceptaran transacciones inv\u00e1lidas, pero podr\u00eda resultar en una divisi\u00f3n de consenso entre nodos Zebra vulnerables y nodos Zebra y Zcashd invulnerables. Este problema ha sido parcheado en la versi\u00f3n 4.3.0 de zebrad y la versi\u00f3n 5.0.1 de zebra-consensus.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"ZcashFoundation\",\"product\":\"zebra\",\"versions\":[{\"version\":\"\u003c 4.3.0\",\"status\":\"affected\"}]},{\"vendor\":\"ZcashFoundation\",\"product\":\"zebra-consensus\",\"versions\":[{\"version\":\"\u003c 5.0.1\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":8.4,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"HIGH\",\"subAvailabilityImpact\":\"HIGH\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-03-31T17:18:05.262524Z\",\"id\":\"CVE-2026-34377\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-347\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zfnd:zebra:*:*:*:*:*:rust:*:*\",\"versionEndExcluding\":\"4.3.0\",\"matchCriteriaId\":\"4B93957D-63A6-4232-8046-FDF593752C05\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zfnd:zebra-consensus:*:*:*:*:*:rust:*:*\",\"versionEndExcluding\":\"5.0.1\",\"matchCriteriaId\":\"D958D1C3-B1F2-48EE-A41C-777DE3C0A8B1\"}]}]}],\"references\":[{\"url\":\"https://github.com/ZcashFoundation/zebra/releases/tag/v4.3.0\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-3vmh-33xr-9cqh\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]},{\"url\":\"https://zfnd.org/zebra-4-3-0-critical-security-fixes-zip-235-support-and-performance-improvements\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2026-04-01T17:03:23+00:00",
      "cve": "CVE-2026-34377",
      "id": "CVE-2026-34377",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Zebra has a Consensus Failure due to Improper Verification of V5 Transactions",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34377.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-34377\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-31T17:18:05.262524Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-31T17:18:09.921Z\"}}], \"cna\": {\"title\": \"Zebra has a Consensus Failure due to Improper Verification of V5 Transactions\", \"source\": {\"advisory\": \"GHSA-3vmh-33xr-9cqh\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 8.4, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"HIGH\", \"subIntegrityImpact\": \"HIGH\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"HIGH\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"ZcashFoundation\", \"product\": \"zebra\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 4.3.0\"}]}, {\"vendor\": \"ZcashFoundation\", \"product\": \"zebra-consensus\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 5.0.1\"}]}], \"references\": [{\"url\": \"https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-3vmh-33xr-9cqh\", \"name\": \"https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-3vmh-33xr-9cqh\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/ZcashFoundation/zebra/releases/tag/v4.3.0\", \"name\": \"https://github.com/ZcashFoundation/zebra/releases/tag/v4.3.0\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://zfnd.org/zebra-4-3-0-critical-security-fixes-zip-235-support-and-performance-improvements\", \"name\": \"https://zfnd.org/zebra-4-3-0-critical-security-fixes-zip-235-support-and-performance-improvements\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-consensus version 5.0.1, a logic error in Zebra\u0027s transaction verification cache could allow a malicious miner to induce a consensus split. By matching a valid transaction\u0027s txid while providing invalid authorization data, a miner could cause vulnerable Zebra nodes to accept an invalid block, leading to a consensus split from the rest of the Zcash network. This would not allow invalid transactions to be accepted but could result in a consensus split between vulnerable Zebra nodes and invulnerable Zebra and Zcashd nodes. This issue has been patched in zebrad version 4.3.0 and zebra-consensus version 5.0.1.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-347\", \"description\": \"CWE-347: Improper Verification of Cryptographic Signature\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-03-31T14:05:59.959Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-34377\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-03-31T17:18:12.932Z\", \"dateReserved\": \"2026-03-27T13:43:14.370Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-03-31T14:05:59.959Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-34377

Vulnerability from fkie_nvd - Published: 2026-03-31 15:16 - Updated: 2026-06-17 10:38

Severity

8.1 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/ZcashFoundation/zebra/releases/tag/v4.3.0	Release Notes
security-advisories@github.com	https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-3vmh-33xr-9cqh	Exploit, Vendor Advisory
security-advisories@github.com	https://zfnd.org/zebra-4-3-0-critical-security-fixes-zip-235-support-and-performance-improvements	Vendor Advisory

Impacted products

	Vendor	Product	Version
	zfnd	zebra	*
	zfnd	zebra-consensus	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "zebra",
          "vendor": "ZcashFoundation",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.3.0"
            }
          ]
        },
        {
          "product": "zebra-consensus",
          "vendor": "ZcashFoundation",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.0.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:zfnd:zebra:*:*:*:*:*:rust:*:*",
              "matchCriteriaId": "4B93957D-63A6-4232-8046-FDF593752C05",
              "versionEndExcluding": "4.3.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zfnd:zebra-consensus:*:*:*:*:*:rust:*:*",
              "matchCriteriaId": "D958D1C3-B1F2-48EE-A41C-777DE3C0A8B1",
              "versionEndExcluding": "5.0.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-consensus version 5.0.1, a logic error in Zebra\u0027s transaction verification cache could allow a malicious miner to induce a consensus split. By matching a valid transaction\u0027s txid while providing invalid authorization data, a miner could cause vulnerable Zebra nodes to accept an invalid block, leading to a consensus split from the rest of the Zcash network. This would not allow invalid transactions to be accepted but could result in a consensus split between vulnerable Zebra nodes and invulnerable Zebra and Zcashd nodes. This issue has been patched in zebrad version 4.3.0 and zebra-consensus version 5.0.1."
    }
  ],
  "id": "CVE-2026-34377",
  "lastModified": "2026-06-17T10:38:58.490",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.4,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "HIGH",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "HIGH",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-34377",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-03-31T17:18:05.262524Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-03-31T15:16:19.233",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/ZcashFoundation/zebra/releases/tag/v4.3.0"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-3vmh-33xr-9cqh"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://zfnd.org/zebra-4-3-0-critical-security-fixes-zip-235-support-and-performance-improvements"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-347"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-3VMH-33XR-9CQH

Vulnerability from github – Published: 2026-03-30 19:13 – Updated: 2026-03-31 18:52

Summary

Zebra has a Consensus Failure due to Improper Verification of V5 Transactions

Details

CVE-2026-34377: Consensus Failure via Crafted V5 Authorization Data

Summary

A logic error in Zebra's transaction verification cache could allow a malicious miner to induce a consensus split. By matching a valid transaction's txid while providing invalid authorization data, a miner could cause vulnerable Zebra nodes to accept an invalid block, leading to a consensus split from the rest of the Zcash network. To be clear, this would not allow invalid transactions to be accepted but could result in a consensus split between vulnerable Zebra nodes and invulnerable Zebra and Zcashd nodes.

Severity

High - This is a Consensus Vulnerability that could allow a malicious miner to induce network partitioning, service disruption, and potential double-spend attacks against affected nodes.

Affected Versions

All Zebra versions supporting V5 transactions (Network Upgrade 5 and later) prior to version 4.3.0.

Description

The vulnerability exists in the find_verified_unmined_tx function within transaction.rs. This function was designed to optimize block verification by checking if a transaction was already verified in the mempool.

The lookup mechanism used the ZIP-244 txid as the unique key. However, for V5 transactions, the txid specifically excludes the Authorization Data Root (signatures and proofs). Because Zebra returned a "verified" status based solely on the txid, it skipped the essential check_v5_auth() call for the transaction version provided in the block.

An attacker (specifically a malicious miner) could exploit this by: 1. Observing a valid V5 transaction broadcast to the network and entering a Zebra node's mempool. 2. Creating a block containing a modified version of that transaction. The modified version has the same txid but contains invalid signatures or proofs. 3. The affected Zebra node identifies the txid in its mempool and incorrectly assumes the block's version of the transaction is already verified. 4. The node commits the block with the invalid transaction data. 5. Other nodes (like zcashd or zebra nodes without that transaction in their mempool) reject the block, resulting in a chain fork where the poisoned Zebra node is isolated.

Impact

Consensus Failure * Attack Vector: Network (specifically via a malicious miner). * Effect: Network partition/consensus split. * Scope: Any Zebra node utilizing the transaction verification cache optimization for V5 transactions.

Fixed Versions

This issue is fixed in Zebra 4.3.0.

The fix ensures that verification is only skipped if the transaction's full integrity—including authorization data—is validated against the mempool entry.

Mitigation

Users should upgrade to Zebra 4.3.0 or later immediately.

There are no known workarounds for this issue. Immediate upgrade is the only way to ensure the node remains on the correct consensus path and is protected against malicious chain forks.

Resources

Severity

8.4 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "zebrad"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "zebra-consensus"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-34377"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-347"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-30T19:13:41Z",
    "nvd_published_at": "2026-03-31T15:16:19Z",
    "severity": "HIGH"
  },
  "details": "---\n\n# CVE-2026-34377: Consensus Failure via Crafted V5 Authorization Data\n\n## Summary\nA logic error in Zebra\u0027s transaction verification cache could allow a malicious miner to induce a consensus split. By matching a valid transaction\u0027s `txid` while providing invalid authorization data, a miner could cause vulnerable Zebra nodes to accept an invalid block, leading to a consensus split from the rest of the Zcash network.  To be clear, **this would not allow invalid transactions to be accepted** but could result in a consensus split between vulnerable Zebra nodes and invulnerable Zebra and Zcashd nodes.\n\n## Severity\n**High** - This is a Consensus Vulnerability that could allow a malicious miner to induce network partitioning, service disruption, and potential double-spend attacks against affected nodes.\n\n## Affected Versions\nAll Zebra versions supporting V5 transactions (Network Upgrade 5 and later) prior to **version 4.3.0**.\n\n## Description\nThe vulnerability exists in the `find_verified_unmined_tx` function within `transaction.rs`. This function was designed to optimize block verification by checking if a transaction was already verified in the mempool.\n\nThe lookup mechanism used the **ZIP-244 `txid`** as the unique key. However, for V5 transactions, the `txid` specifically excludes the **Authorization Data Root** (signatures and proofs). Because Zebra returned a \"verified\" status based solely on the `txid`, it skipped the essential `check_v5_auth()` call for the transaction version provided in the block.\n\nAn attacker (specifically a malicious miner) could exploit this by:\n1. Observing a valid V5 transaction broadcast to the network and entering a Zebra node\u0027s mempool.\n2. Creating a block containing a modified version of that transaction. The modified version has the same `txid` but contains invalid signatures or proofs.\n3. The affected Zebra node identifies the `txid` in its mempool and incorrectly assumes the block\u0027s version of the transaction is already verified.\n4. The node commits the block with the invalid transaction data.\n5. Other nodes (like `zcashd` or `zebra` nodes without that transaction in their mempool) reject the block, resulting in a chain fork where the poisoned Zebra node is isolated.\n\n## Impact\n**Consensus Failure**\n* **Attack Vector:** Network (specifically via a malicious miner).\n* **Effect:** Network partition/consensus split.\n* **Scope:** Any Zebra node utilizing the transaction verification cache optimization for V5 transactions.\n\n## Fixed Versions\nThis issue is fixed in **Zebra 4.3.0**. \n\nThe fix ensures that verification is only skipped if the transaction\u0027s full integrity\u2014including authorization data\u2014is validated against the mempool entry.\n\n## Mitigation\nUsers should upgrade to **Zebra 4.3.0** or later immediately. \n\nThere are no known workarounds for this issue. Immediate upgrade is the only way to ensure the node remains on the correct consensus path and is protected against malicious chain forks.\n\n## Resources\n* [Zebra 4.3.0 Release Announcement](https://zfnd.org/zebra-4-3-0-critical-security-fixes-zip-235-support-and-performance-improvements/)\n* [ZIP-244: Transaction Identifier](https://zips.z.cash/zip-0244)\n\n---",
  "id": "GHSA-3vmh-33xr-9cqh",
  "modified": "2026-03-31T18:52:14Z",
  "published": "2026-03-30T19:13:41Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-3vmh-33xr-9cqh"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34377"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ZcashFoundation/zebra"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ZcashFoundation/zebra/releases/tag/v4.3.0"
    },
    {
      "type": "WEB",
      "url": "https://zfnd.org/zebra-4-3-0-critical-security-fixes-zip-235-support-and-performance-improvements"
    },
    {
      "type": "WEB",
      "url": "https://zips.z.cash/zip-0244"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Zebra has a Consensus Failure due to Improper Verification of V5 Transactions"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-34377 (GCVE-0-2026-34377)

FKIE_CVE-2026-34377

GHSA-3VMH-33XR-9CQH

CVE-2026-34377: Consensus Failure via Crafted V5 Authorization Data

Summary

Severity

Affected Versions

Description

Impact

Fixed Versions

Mitigation

Resources

Tags

Sightings

Nomenclature