Executive brief
Zebra is an independent software implementation of a Zcash cryptocurrency node. A vulnerability in how the software processes transaction data allows a remote attacker to crash the node by sending a single malicious message. This results in a denial-of-service, preventing the node from participating in the blockchain network or processing transactions until it is manually restarted.
Technical details
The vulnerability exists in Zebra's transaction processing logic due to lazy validation of V5 transaction fields. While the network codec successfully deserializes malformed V5 transactions into the 'zebra-chain' Transaction type, a panic is triggered when the node attempts to convert these transactions into internal types for TxID or auth digest calculation. An attacker can exploit this by sending a crafted 'tx' message to the node's public P2P port (default 8233) or via the 'sendrawtransaction' RPC method. The fix in version 4.3.0 ensures that transactions failing TxID calculation are rejected during the initial deserialization phase and replaces internal panics with graceful error handling.
Affected products
- ZcashFoundation zebrad < 4.3.0
- ZcashFoundation zebra-chain < 6.0.1
Timeline
- 2026-03-25: patched: Release of version 4.3.0
- 2026-03-27: advisory: GitHub Security Advisory published
- 2026-03-31: disclosed: CVE published to NVD