Logic Error in Zcash Node Software Affects Zebra by Zcash Foundation

CVE-2026-34377

What is CVE-2026-34377?

A logic error in the transaction verification cache of Zebra, a Zcash node implemented in Rust, allows malicious miners to provoke a consensus split. This vulnerability permits a miner to match a valid transaction's transaction ID while supplying invalid authorization data. As a result, vulnerable Zebra nodes may accept an invalid block, separating them from the valid Zcash network. Importantly, while this does not enable the acceptance of invalid transactions, it can result in a significant consensus split between the vulnerable Zebra nodes and unaffected Zebra and Zcashd nodes. This issue has been resolved in zebrad version 4.3.0 and zebra-consensus version 5.0.1.

References