CVE-2026-34202: DoS in Zebra Node V5 Transactions

This vulnerability allows a remote, unauthenticated attacker to induce a denial of service by crashing a Zebra node. The attack involves sending a malicious V5 transaction that bypasses initial deserialization but causes a failure during transaction ID calculation, leading to a panic. The impact is significant as it can disrupt critical network operations and potentially lead to data loss or service unavailability. The lack of authentication makes exploitation trivial, and a single malicious transaction is sufficient to trigger the DoS. This vulnerability shares similarities with other transaction processing vulnerabilities where malformed input can lead to unexpected crashes.

1. Reserved2026-03-26
2. Published2026-03-27
3. Modified2026-04-09
4. EPSS updated2026-04-08

The primary mitigation is to upgrade Zebra nodes to version 4.3.0 or later, which includes the fix for this vulnerability. If immediate upgrading is not possible, consider restricting access to V5 transactions to trusted sources only. Implement network segmentation to limit the potential blast radius of a successful attack. Monitor network traffic for suspicious V5 transaction patterns. While no specific detection signatures are available, unusual transaction volumes or error rates related to V5 processing should be investigated. After upgrading, confirm the fix by sending a test V5 transaction and verifying that the node does not crash.