https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 18:24:58 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-278308 EUVD-2026-278308 https://cve.radiocsirt.org/vuln/euvd-2026-278308 https://cve.radiocsirt.org/vuln/fkie_cve-2026-34377 <p>ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-consensus version 5.0.1, a logic error in Zebra&#39;s transaction verification cache could allow a malicious miner to induce a consensus split. By matching a valid transaction&#39;s txid while providing invalid authorization data, a miner could cause vulnerable Zebra nodes to accept an invalid block, leading to a consensus split from the rest of the Zcash network. This would not allow invalid transactions to be accepted but could result in a consensus split between vulnerable Zebra nodes and invulnerable Zebra and Zcashd nodes. This issue has been patched in zebrad version 4.3.0 and zebra-consensus version 5.0.1.</p> <p>ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-consensus version 5.0.1, a logic error in Zebra&#39;s transaction verification cache could allow a malicious miner to induce a consensus split. By matching a valid transaction&#39;s txid while providing invalid authorization data, a miner could cause vulnerable Zebra nodes to accept an invalid block, leading to a consensus split from the rest of the Zcash network. This would not allow invalid transactions to be accepted but could result in a consensus split between vulnerable Zebra nodes and invulnerable Zebra and Zcashd nodes. This issue has been patched in zebrad version 4.3.0 and zebra-consensus version 5.0.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-34377 https://cve.radiocsirt.org/vuln/ghsa-3vmh-33xr-9cqh <p><strong>Affected:</strong> crates.io: zebrad, crates.io: zebra-consensus</p> <p>---</p> <p># CVE-2026-34377: Consensus Failure via Crafted V5 Authorization Data</p> <p>## Summary A logic error in Zebra&#39;s transaction verification cache could allow a malicious miner to induce a consensus split. By matching a valid transaction&#39;s `txid` while providing invalid authorization data, a miner could cause vulnerable Zebra nodes to accept an invalid block, leading to a consensus split from the rest of the Zcash network. To be clear, **this would not allow invalid transactions to be accepted** but could result in a consensus split between vulnerable Zebra nodes and invulnerable Zebra and Zcashd nodes.</p> <p>## Severity **High** - This is a Consensus Vulnerability that could allow a malicious miner to induce network partitioning, service disruption, and potential double-spend attacks against affected nodes.</p> <p>## Affected Versions All Zebra versions supporting V5 transactions (Network Upgrade 5 and later) prior to **version 4.3.0**.</p> <p>## Description The vulnerability exists in the `find_verified_unmined_tx` function within `transaction.rs`. This function was designed to optimize block verification by checking if a transaction was already verified in the mempool.</p> <p>The lookup mechanism used the **ZIP-244 `txid`** as the unique key. However, for V5 transactions, the `txid` specifically excludes the **Authorization Data Root** (signatures and proofs). Because Zebra returned a &#34;verified&#34; status based solely on the `txid`, it skipped the essential `check_v5_auth()` call for the transaction…</p> <p><strong>Affected:</strong> crates.io: zebrad, crates.io: zebra-consensus</p> <p>---</p> <p># CVE-2026-34377: Consensus Failure via Crafted V5 Authorization Data</p> <p>## Summary A logic error in Zebra&#39;s transaction verification cache could allow a malicious miner to induce a consensus split. By matching a valid transaction&#39;s `txid` while providing invalid authorization data, a miner could cause vulnerable Zebra nodes to accept an invalid block, leading to a consensus split from the rest of the Zcash network. To be clear, **this would not allow invalid transactions to be accepted** but could result in a consensus split between vulnerable Zebra nodes and invulnerable Zebra and Zcashd nodes.</p> <p>## Severity **High** - This is a Consensus Vulnerability that could allow a malicious miner to induce network partitioning, service disruption, and potential double-spend attacks against affected nodes.</p> <p>## Affected Versions All Zebra versions supporting V5 transactions (Network Upgrade 5 and later) prior to **version 4.3.0**.</p> <p>## Description The vulnerability exists in the `find_verified_unmined_tx` function within `transaction.rs`. This function was designed to optimize block verification by checking if a transaction was already verified in the mempool.</p> <p>The lookup mechanism used the **ZIP-244 `txid`** as the unique key. However, for V5 transactions, the `txid` specifically excludes the **Authorization Data Root** (signatures and proofs). Because Zebra returned a &#34;verified&#34; status based solely on the `txid`, it skipped the essential `check_v5_auth()` call for the transaction…</p> https://cve.radiocsirt.org/vuln/ghsa-3vmh-33xr-9cqh