Skip to content
Latest alertgo-ethereum v1.17.8 security release fixes p2p DoS issues and a STUN-response node crash
0xCERT
Report incident
All advisories
High0xCERT-2026-0224·

Zebra has a Consensus Failure due to Improper Verification of V5 Transactions

Zebra has a Consensus Failure due to Improper Verification of V5 Transactions. --- A logic error in Zebra's transaction verification cache could allow a malicious miner to induce a consensus split. By matching a valid transaction's txid while providing invalid authorization data, a miner could cause vulnerable Zebra nodes to accept an invalid block, leading to a consensus split from the rest of the Zcash network.

Vuln-watch · relayed from the GitHub Advisory Database; see Source & attribution below

Summary

--- A logic error in Zebra's transaction verification cache could allow a malicious miner to induce a consensus split. By matching a valid transaction's txid while providing invalid authorization data, a miner could cause vulnerable Zebra nodes to accept an invalid block, leading to a consensus split from the rest of the Zcash network.

Affected

  • zebrad (rust) < 4.3.0 — fixed in 4.3.0
  • zebra-consensus (rust) < 5.0.1 — fixed in 5.0.1

Severity

High (CVSS 8.4), as rated by the upstream advisory.

Recommended actions

  • Upgrade zebrad to 4.3.0 or later
  • Upgrade zebra-consensus to 5.0.1 or later

Source & attribution

This 0xCERT advisory summarises GHSA-3vmh-33xr-9cqh / CVE-2026-34377 from the GitHub Advisory Database, credited upstream to conradoplg, mpguerra, alchemydc: https://github.com/advisories/GHSA-3vmh-33xr-9cqh. Details may change; refer to the original source for the authoritative record.

References

OpenPGP-signed. The signed text of this advisory verifies against the 0xCERT key CCC7 D9EC 9415 723D.

Published 2026-03-30 · last updated 2026-10-08

curl -s https://www.0xcert.com/pgp.asc | gpg --import && curl -s https://www.0xcert.com/advisory/0xCERT-2026-0224/signed.txt | gpg --verify