CVE-2026-34202

Katalog CVE

CVSS 7.5 · High EPSS 0,93%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada zfnd zebra, zfnd zebra-chain. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-chain version 6.0.1, a vulnerability in Zebra's transaction processing logic allows a remote, unauthenticated attacker to cause a Zebra node to panic (crash). This is triggered by sending a specially crafted V5 transaction that passes initial deserialization but fails during transaction ID calculation. This issue has been patched in zebrad version 4.3.0 and zebra-chain version 6.0.1.

Rincian

Terbit di NVD

31 Maret 2026

Terakhir diubah

24 Juli 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine
CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

0,93% peluang dieksploitasi; lebih tinggi dari 59,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-qp6f-w4r3-h8wg advisory vendor
• https://zfnd.org/zebra-4-3-0-critical-security-fixes-zip-235-support-and-performance-improvements advisory vendor
• https://github.com/ZcashFoundation/zebra/releases/tag/v4.3.0 release notes