PT-2026-29168 · Zebra+1 · Zebra+1

Conradoplg · Published 2026-03-30 · Updated 2026-03-31 · CVE-2026-34377

Positive Technologies (AI Summary)

CVSS v4.0

8.4

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Zebra versions prior to 4.3.0 zebra-consensus versions prior to 5.0.1

Description A flaw exists in Zebra's transaction verification cache that could allow a malicious miner to induce a consensus split. By matching a valid transaction's txid while providing invalid authorization data, a miner could cause vulnerable Zebra nodes to accept an invalid block, leading to a consensus split from the rest of the Zcash network. This issue stems from a logic error in the find verified unmined tx function within transaction.rs, where the lookup mechanism used the txid as a unique key, excluding the Authorization Data Root for V5 transactions. This caused Zebra to skip the essential check v5 auth() call, incorrectly assuming the transaction was already verified. The vulnerability affects Zebra nodes utilizing the transaction verification cache optimization for V5 transactions.

Recommendations Upgrade to Zebra version 4.3.0 or later. Upgrade to zebra-consensus version 5.0.1 or later.

Exploit

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2026-34377

GHSA-3VMH-33XR-9CQH

Affected Products

Zebra

Zebra-Consensus

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34377.json · Exploit
• https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-3vmh-33xr-9cqh · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3vmh-33xr-9cqh · Vendor Advisory
• https://zfnd.org/zebra-4-3-0-critical-security-fixes-zip-235-support-and-performance-improvements · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-34377 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34377 · Security Note
• https://github.com/ZcashFoundation/zebra · Note
• https://github.com/ZcashFoundation/zebra/releases/tag/v4.3.0 · Note
• https://twitter.com/dailycve/status/2038967067806687734 · Twitter Post
• https://twitter.com/CVEnew/status/2039004447792099477 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1s8lx07/resumen_diario_de_vulnerabilidades_31032026 · Reddit Post
• https://zips.z.cash/zip-0244 · Note