External risk intelligence

Zebra Node Remote Crash Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-34202

Zebra is a Zcash node implementation. Cryptocurrency nodes are designed by necessity to be internet-facing to participate in peer-to-peer network discovery, transaction broadcasting, and block synchronization with other nodes globally.

Code Injection

Zfnd Zebra

before 4.3.0before 6.0.1

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in ZEBRA, a Zcash node implementation written in Rust. An unauthenticated remote attacker could exploit this by sending a specially crafted transaction, causing a ZEBRA node to crash. The issue has been addressed in recent versions of ZEBRA and zebra-chain.

Flaw allows attackers to crash ZEBRA nodes.
High impact on Zcash network availability.
Confirm relevance and ensure nodes are updated.

Attack Path

How an attacker could exploit the issue

An attacker can remotely send a specially crafted transaction to a vulnerable Zcash node. This transaction, though appearing valid initially, causes an issue during transaction ID calculation, leading to a crash.

Entry condition: Network access, no authentication.
Trigger point: Sending a malformed V5 transaction.
Resulting risk: Node crash.

Live Threat

Current exploitation, exposure, and threat context

A remote attacker could cause a Zcash node to crash by sending a specially crafted transaction. This could disrupt the availability of the node's services, preventing it from processing or relaying transactions.

Node availability could be affected.
Specially crafted transactions could be sent.
Service disruption could occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

The zfnd zebra node software is susceptible to a remote, unauthenticated denial-of-service vulnerability. This impacts teams responsible for core blockchain infrastructure, likely platform or infrastructure teams managing the Zcash node deployments. The immediate practical next step is to identify all instances of affected zebra versions, assess their network exposure and criticality, and then coordinate remediation efforts with the vendor or internal teams by planning an upgrade during a maintenance window.

Platform/Infrastructure teams own the fix.
Verify network exposure and criticality.
Plan and execute version upgrades.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is ZEBRA and why is it used?

ZEBRA is a full-node implementation for the Zcash blockchain, written in the Rust programming language. It is designed to participate in the Zcash peer-to-peer network, where it synchronizes blockchain data, validates transactions, and relays information to other nodes. People run ZEBRA nodes to support the network's decentralization and to provide a reliable interface for interacting with the Zcash ledger.

How does CVE-2026-34202 cause a crash?

This vulnerability involves an issue with how the software handles specific transaction data, categorized as an improper neutralization of input during a calculation. While the incoming data might look correct at first glance, the node encounters a fatal error when it attempts to compute the unique ID for a specifically crafted V5 transaction. This internal processing failure causes the entire node to stop running.

What triggers this ZEBRA vulnerability?

An attacker triggers this bug by sending a malformed V5 transaction to the node over the network. The vulnerability is triggered during the transaction ID calculation phase rather than during initial deserialization. Valid, standard transactions that do not match this specific malicious pattern do not cause the crash, as the issue is isolated to the logic governing the processing of specially crafted, invalid V5 data.

Is my node at risk according to Halo Surface Signal?

Yes, if you run an affected version, your risk is significant. Halo Surface Signal notes that Zcash nodes are intended to be internet-facing to facilitate global block synchronization and network discovery. Because ZEBRA nodes must remain accessible to the peer-to-peer network to function, they are naturally exposed to remote, unauthenticated traffic, making them reachable targets for this attack.

How do I fix this ZEBRA node issue?

The resolution requires updating your software to the patched versions provided by the vendor. Ensure your environment is running at least zebrad version 4.3.0 and zebra-chain version 6.0.1. Platform teams should inventory all deployed instances, prioritize the upgrade to restore service stability, and schedule the necessary maintenance to apply these versions, as the current flaw directly impacts the node's availability.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.