PT-2026-28604 · Zebra · Zebra

Robustfengbin · Publicado 2026-03-27 · Atualizado 2026-03-31 · CVE-2026-34202

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Crítica

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Name of the Vulnerable Software and Affected Versions Zebra versions prior to 4.3.0

Description A flaw exists in Zebra’s transaction processing logic that allows a remote, unauthenticated attacker to cause a Zebra node to crash. This is triggered by sending a specially crafted V5 transaction that passes initial deserialization but fails during transaction ID calculation. The issue stems from Zebra lazily validating transaction fields. An attacker can trigger this crash by sending a single crafted tx message to a Zebra node's public P2P port or via the sendrawtransaction API endpoint. The PushTransaction messages with malformed V5 transactions are successfully deserialized as the zebra-chain Transaction type.

Recommendations Upgrade to Zebra version 4.3.0 or later immediately. If an immediate upgrade is not possible, ensure the RPC port is not exposed to the Internet. Restrict the P2P port to trusted peers to fully mitigate the risk.

Exploit

Correção

DoS

Code Injection

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-94

CWE-1336

CWE-502

Identificadores relacionados

CVE-2026-34202

GHSA-QP6F-W4R3-H8WG

Produtos afetados

Zebra

Referências · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34202.json · Exploit
• https://github.com/ZcashFoundation/zebra · Nota
• https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-qp6f-w4r3-h8wg · Aviso do Fabricante
• https://github.com/ZcashFoundation/zebra/releases/tag/v4.3.0 · Nota
• https://twitter.com/CVEnew/status/2039004448874221998 · Publicação no Twitter
• https://zfnd.org/zebra-4-3-0-critical-security-fixes-zip-235-support-and-performance-improvements · Aviso do Fabricante
• https://twitter.com/0dayPublishing/status/2038985838541897940 · Publicação no Twitter
• https://twitter.com/robustdragon/status/2038598486921277613 · Publicação no Twitter
• https://reddit.com/r/VulnMatter/comments/1s6lazl/resumen_diario_de_vulnerabilidades_29032026 · Publicação no Reddit
• https://osv.dev/vulnerability/GHSA-qp6f-w4r3-h8wg · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-34202 · Aviso do Fabricante
• https://twitter.com/pulsepatchio/status/2038264525841924455 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-34202 · Nota de Segurança