CRITICAL🇵🇱 Wersja polska

CVE-2026-44498

CVSS 9.2v4.0pub. 2026-05-08

ZEBRA is a Zcash node written entirely in Rust. Prior to version 4.4.0, Zebra's block validator undercounts transparent signature operations against the 20000-sigop block limit (MAX_BLOCK_SIGOPS), allowing it to accept blocks that zcashd rejects with bad-blk-sigops. A miner who produces such a block can split the network: Zebra nodes follow the offending chain while zcashd nodes do not. This issue has been patched in version 4.4.0.

🇵🇱 Read Polish description →

🤖 AI Analysis

How it works

The block validator in Zebra prior to version 4.4.0 incorrectly counted transparent signature operations (transparent signature operations) against the MAX_BLOCK_SIGOPS limit of 20,000 sigops per block. Undercounting causes Zebra to accept blocks that zcashd rejects as violating the limit (bad-blk-sigops error). A miner that deliberately produces such a block exceeding the actual limit can lead to a situation where Zebra nodes follow a different chain than zcashd nodes.

Impact

An attacker (miner) can trigger a permanent network split in Zcash: Zebra nodes and zcashd nodes will start tracking different block chains, which threatens the integrity and consistency of the entire blockchain network. Transaction disruptions, double spending, and network consensus disorganization are possible.

Mitigation & patch

Zebra must be updated to version 4.4.0 or later, in which the problem has been fixed. Patch available in the ZcashFoundation GitHub repository: https://github.com/ZcashFoundation/zebra/releases/tag/v4.4.0

Who is affected

Zebrad (Zcash node of the ZcashFoundation project) in all versions prior to 4.4.0

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X