CRITICAL🇵🇱 Wersja polska

CVE-2026-44497

CVSS 9.3v4.0pub. 2026-05-08

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.4.0 and prior to zebra-script version 6.0.0, the fix for CVE-2026-41583 introduced a separate issue due to insufficient error handling of the case where the sighash type is invalid, during sighash computation. Instead of returning an error, the normal flow would resume, and the input sighash buffer would be left untouched. In scenarios where a previous signature validation could leave a valid sighash in the buffer, an invalid hash-type could be incorrectly accepted, which would create a consensus split between Zebra and zcashd nodes. This issue has been patched in zebrad version 4.4.0 and zebra-script version 6.0.0.

🇵🇱 Read Polish description →

🤖 AI Analysis

How it works

During sighash calculation, the fix for CVE-2026-41583 introduced insufficient error handling for the case when the sighash type is invalid. Instead of returning an error, the code continues normal execution flow, leaving the sighash buffer unchanged. If the previous signature validation left a valid sighash in the buffer, an invalid hash type may be incorrectly accepted as valid. This results in a discrepancy in the assessment of transaction validity between ZEBRA nodes and zcashd.

Impact

An attacker can cause a consensus split (consensus split) between ZEBRA nodes and zcashd, threatening the integrity and consistency of the Zcash network and enabling potential manipulation of transaction verification.

Mitigation & patch

Update zebrad to version 4.4.0 or newer and zebra-script to version 6.0.0 or newer. Patches are available in the ZcashFoundation/zebra repository.

Who is affected

Zfnd zebrad in versions prior to 4.4.0 and Zfnd zebra-script in versions prior to 6.0.0.

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X