Is CVE-2026-34202 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34202 being exploited in the wild.

How severe is CVE-2026-34202?

High severity, with a CVSS score of 7.5, published 31 March 2026.

Which products and versions are affected?

zebra-chain (crates.io) SEMVER:introduced=0,fixed=6.0.1; zebrad (crates.io) SEMVER:introduced=0,fixed=4.3.0.

Is there a fix for CVE-2026-34202?

Yes. zebra-chain (crates.io): upgrade to 6.0.1 or later; zebrad (crates.io): upgrade to 4.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-34202 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-34202?

Check whether you run zebra-chain (crates.io) or zebrad (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34202: ZcashFoundation Zebra remote denial of service via crafted V5 transactions

CVE-2026-34202 · Severity: high · CVSS 7.5 · Published 2026-03-31

Zebra is an independent software implementation of a Zcash cryptocurrency node. A vulnerability in how the software processes transaction data allows a remote attacker to crash the node by sending a single malicious message. This results in a denial-of-service, preventing the node from participating in the blockchain network or processing transactions until it is manually restarted.

Technologies: zebra-chain (crates.io), zebrad (crates.io). Vendors: crates.io.

Quick answers

Is CVE-2026-34202 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34202 being exploited in the wild.
How severe is CVE-2026-34202?: High severity, with a CVSS score of 7.5, published 31 March 2026.
Which products and versions are affected?: zebra-chain (crates.io) SEMVER:introduced=0,fixed=6.0.1; zebrad (crates.io) SEMVER:introduced=0,fixed=4.3.0.
Is there a fix for CVE-2026-34202?: Yes. zebra-chain (crates.io): upgrade to 6.0.1 or later; zebrad (crates.io): upgrade to 4.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34202 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-34202?: Check whether you run zebra-chain (crates.io) or zebrad (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

zebra-chain (crates.io): upgrade to 6.0.1 or later
```
cargo update -p zebra-chain
```
zebrad (crates.io): upgrade to 4.3.0 or later
```
cargo update -p zebrad
```

Technical details

The vulnerability exists in Zebra's transaction processing logic due to lazy validation of V5 transaction fields. While the network codec successfully deserializes malformed V5 transactions into the 'zebra-chain' Transaction type, a panic is triggered when the node attempts to convert these transactions into internal types for TxID or auth digest calculation. An attacker can exploit this by sending a crafted 'tx' message to the node's public P2P port (default 8233) or via the 'sendrawtransaction' RPC method. The fix in version 4.3.0 ensures that transactions failing TxID calculation are rejected during the initial deserialization phase and replaces internal panics with graceful error handling.

Affected products

ZcashFoundation zebrad < 4.3.0
ZcashFoundation zebra-chain < 6.0.1

Identifiers

CVE-2026-34202
GHSA-qp6f-w4r3-h8wg

Timeline

2026-03-25: patched: Release of version 4.3.0
2026-03-27: advisory: GitHub Security Advisory published
2026-03-31: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.