CVE-2026-34202

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-chain version 6.0.1, a vulnerability in Zebra's transaction processing logic allows a remote, unauthenticated attacker to cause a Zebra node to panic (crash). This is triggered by sending a specially crafted V5 transaction that passes initial deserialization but fails during transaction ID calculation. This issue has been patched in zebrad version 4.3.0 and zebra-chain version 6.0.1.

• CWE-94
• CWE-1336
• CWE-502

• https://github.com/ZcashFoundation/zebra/releases/tag/v4.3.0Release Notes
• https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-qp6f-w4r3-h8wgVendor Advisory
• https://zfnd.org/zebra-4-3-0-critical-security-fixes-zip-235-support-and-performance-improvementsVendor Advisory

Published

Mar 31, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-34194Software installed and run as a non-privileged user may cond…7.1
• CVE-2026-34195Software installed and run as a non-privileged user may cond…8.8
• CVE-2026-34196Software installed and run as a non-privileged user may cond…7.8
• CVE-2026-34197Improper Input Validation, Improper Control of Generation of…8.8
• CVE-2026-34198Coolify is an open-source and self-hostable tool for managin…5.3
• CVE-2026-34200Nhost is an open source Firebase alternative with GraphQL. P…7.5
• CVE-2026-34203Nautobot is a Network Source of Truth and Network Automation…4.3
• CVE-2026-34204MinIO is a high-performance object storage system. Prior to …7.1
• CVE-2026-34205Home Assistant is open source home automation software that …9.6
• CVE-2026-34206Captcha Protect is a Traefik middleware to add an anti-bot c…6.1
• CVE-2026-34207TypeBot is a chatbot builder tool. In versions prior to 3.16…7.6
• CVE-2026-34208SandboxJS is a JavaScript sandboxing library. Prior to 0.8.3…10