PT-2026-28604 · Zebra · Zebra

Robustfengbin · Published 2026-03-27 · Updated 2026-03-31 · CVE-2026-34202

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Name of the Vulnerable Software and Affected Versions Zebra versions prior to 4.3.0

Description A flaw exists in Zebra’s transaction processing logic that allows a remote, unauthenticated attacker to cause a Zebra node to crash. This is triggered by sending a specially crafted V5 transaction that passes initial deserialization but fails during transaction ID calculation. The issue stems from Zebra lazily validating transaction fields. An attacker can trigger this crash by sending a single crafted tx message to a Zebra node's public P2P port or via the sendrawtransaction API endpoint. The PushTransaction messages with malformed V5 transactions are successfully deserialized as the zebra-chain Transaction type.

Recommendations Upgrade to Zebra version 4.3.0 or later immediately. If an immediate upgrade is not possible, ensure the RPC port is not exposed to the Internet. Restrict the P2P port to trusted peers to fully mitigate the risk.

Exploit

Fix

DoS

Code Injection

Deserialization of Untrusted Data

Weakness Enumeration

CWE-94

CWE-1336

CWE-502

Related Identifiers

CVE-2026-34202

GHSA-QP6F-W4R3-H8WG

Affected Products

Zebra

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34202.json · Exploit
• https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-qp6f-w4r3-h8wg · Vendor Advisory
• https://zfnd.org/zebra-4-3-0-critical-security-fixes-zip-235-support-and-performance-improvements · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qp6f-w4r3-h8wg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-34202 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34202 · Security Note
• https://github.com/ZcashFoundation/zebra · Note
• https://github.com/ZcashFoundation/zebra/releases/tag/v4.3.0 · Note
• https://twitter.com/CVEnew/status/2039004448874221998 · Twitter Post
• https://twitter.com/0dayPublishing/status/2038985838541897940 · Twitter Post
• https://twitter.com/robustdragon/status/2038598486921277613 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1s6lazl/resumen_diario_de_vulnerabilidades_29032026 · Reddit Post
• https://twitter.com/pulsepatchio/status/2038264525841924455 · Twitter Post