CVE-2026-41583 Details
Description
ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.1 and prior to zebra-script version 5.0.2, after a refactoring, Zebra failed to validate a consensus rule that restricted the possible values of sighash hash types for V5 transactions which were enabled in the NU5 network upgrade. Zebra nodes could thus accept and eventually mine a block that would be considered invalid by zcashd nodes, creating a consensus split between Zebra and zcashd nodes. In a similar vein, for V4 transactions, Zebra mistakenly used the "canonical" hash type when computing the sighash while zcashd (correctly per the spec) uses the raw value, which could also crate a consensus split. This issue has been patched in zebrad version 4.3.1 and zebra-script version 5.0.2.
A consensus vulnerability has been identified in ZEBRA, a Zcash node implementation in Rust, affecting versions prior to 4.3.1 for zebrad and prior to 5.0.2 for zebra-script. The issue arises from a failure to properly validate the allowed values of sighash hash types for V5 transactions, introduced in the NU5 network upgrade. This oversight allows ZEBRA nodes to accept and mine blocks that would be deemed invalid by zcashd nodes, leading to a consensus split. Similarly, for V4 transactions, ZEBRA incorrectly applied the 'canonical' hash type when calculating the sighash, while zcashd used the raw value as specified, potentially causing another consensus divergence.
Users should upgrade to ZEBRA version 4.3.1 or later. There are no known workarounds.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-8m29-fpq5-89jj | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-573 | Improper Following of Specification by Caller | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| zfnd zebra-script | < 5.0.2 |
CPE
Remediation
| |
| zfnd zebrad | < 4.3.1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 8, 2026 | Initial Analysis | [email protected] |
| May 8, 2026 | New CVE Received | [email protected] |