https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T17:45:39.810185+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-278308 EUVD-2026-278308 2026-10-06T17:45:39.869162+00:00 EUVD-2026-278308 https://cve.radiocsirt.org/vuln/fkie_cve-2026-34377 fkie_cve-2026-34377 2026-10-06T17:45:39.869204+00:00

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-consensus version 5.0.1, a logic error in Zebra's transaction verification cache could allow a malicious miner to induce a consensus split. By matching a valid transaction's txid while providing invalid authorization data, a miner could cause vulnerable Zebra nodes to accept an invalid block, leading to a consensus split from the rest of the Zcash network. This would not allow invalid transactions to be accepted but could result in a consensus split between vulnerable Zebra nodes and invulnerable Zebra and Zcashd nodes. This issue has been patched in zebrad version 4.3.0 and zebra-consensus version 5.0.1.

 https://cve.radiocsirt.org/vuln/ghsa-3vmh-33xr-9cqh GHSA-3vmh-33xr-9cqh — Zebra has a Consensus Failure due to Improper Verification of V5 Transactions 2026-10-06T17:45:39.869243+00:00

Affected: crates.io: zebrad, crates.io: zebra-consensus

---

# CVE-2026-34377: Consensus Failure via Crafted V5 Authorization Data

## Summary A logic error in Zebra's transaction verification cache could allow a malicious miner to induce a consensus split. By matching a valid transaction's `txid` while providing invalid authorization data, a miner could cause vulnerable Zebra nodes to accept an invalid block, leading to a consensus split from the rest of the Zcash network. To be clear, **this would not allow invalid transactions to be accepted** but could result in a consensus split between vulnerable Zebra nodes and invulnerable Zebra and Zcashd nodes.

## Severity **High** - This is a Consensus Vulnerability that could allow a malicious miner to induce network partitioning, service disruption, and potential double-spend attacks against affected nodes.

## Affected Versions All Zebra versions supporting V5 transactions (Network Upgrade 5 and later) prior to **version 4.3.0**.

## Description The vulnerability exists in the `find_verified_unmined_tx` function within `transaction.rs`. This function was designed to optimize block verification by checking if a transaction was already verified in the mempool.

The lookup mechanism used the **ZIP-244 `txid`** as the unique key. However, for V5 transactions, the `txid` specifically excludes the **Authorization Data Root** (signatures and proofs). Because Zebra returned a "verified" status based solely on the `txid`, it skipped the essential `check_v5_auth()` call for the transaction…