Zebra 4.3.0 Security Advisory: Fixes for CVE-2026-34202 (DoS) and CVE-2026-34377 (Consensus Failure)

### Vulnerability Key Information Summary #### 1. Vulnerability Overview This page discloses two critical security vulnerabilities related to the Zebra 4.3.0 version: * **CVE-2026-34202 (Critical, CVSS 9.2)**: **Remote Denial of Service via Crafted V5 Transactions**. * Description: The transaction validation logic in Zebra allows remote unauthenticated attackers to trigger a panic (program crash) during transaction ID calculation by sending crafted V5 transactions. * **CVE-2026-34377 (High, CVSS 8.4)**: **Consensus Failure via Crafted V5 Authorization Data**. * Description: A flaw in Zebra's transaction validation logic allows malicious miners to induce a consensus split. Attackers can cause transactions to be accepted while potentially triggering a chain split by matching the txId of valid transactions but providing invalid authorization data. #### 2. Scope of Impact * **Affected Components**: Zebra node transaction verification and deserialization logic. * **Potential Consequences**: * Node crashes (Panic). * Consensus splits, isolating the node from the rest of the network. * Denial of Service (DoS) attacks. #### 3. Remediation * **Upgrade Recommendation**: All Zebra node operators are strongly advised to upgrade to **Zebra 4.3.0** immediately. * **Specific Remediation Measures**: * **For CVE-2026-34202**: Fixed the panic occurring during transaction ID calculation, replacing it with graceful error handling. * **For CVE-2026-34377**: Ensured validation is only skipped when full transaction integrity (including authorization data) is verified. * **V5 Transaction Verification Bypass Fix**: Fixed the consensus logic to no longer automatically mark V5 transactions as verified based solely on mined transaction IDs, preventing chain splits caused by skipping proof checks. * **Deserialization Panic Fix**: Added appropriate validation to ensure transactions can be safely deserialized before further processing.

Goal Reached Thanks to every supporter — we hit 100%!

Zebra 4.3.0 Security Advisory: Fixes for CVE-2026-34202 (DoS) and CVE-2026-34377 (Consensus Failure)