CVE-2026-44497 Details
Description
ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.4.0 and prior to zebra-script version 6.0.0, the fix for CVE-2026-41583 introduced a separate issue due to insufficient error handling of the case where the sighash type is invalid, during sighash computation. Instead of returning an error, the normal flow would resume, and the input sighash buffer would be left untouched. In scenarios where a previous signature validation could leave a valid sighash in the buffer, an invalid hash-type could be incorrectly accepted, which would create a consensus split between Zebra and zcashd nodes. This issue has been patched in zebrad version 4.4.0 and zebra-script version 6.0.0.
A consensus vulnerability has been identified in ZEBRA, a Zcash node implementation in Rust, affecting versions prior to 4.4.0 and zebra-script versions prior to 6.0.0. The issue arises from inadequate error handling when the sighash type is invalid during computation. Instead of signaling an error, the process would continue, leaving the input sighash buffer unchanged. This could allow an invalid hash type to be accepted, creating a consensus divergence between ZEBRA and zcashd nodes. The vulnerability could be exploited by constructing a transparent output that takes advantage of the flawed sighash handling, leading to a rejection of the transaction by zcashd but acceptance by ZEBRA, thereby causing a split in the network consensus.
Users should upgrade to ZEBRA version 4.4.0 or later. There are no known workarounds for this issue.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-gq4h-3grw-2rhv | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-347 | Improper Verification of Cryptographic Signature | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| zfnd zebra-script | < 6.0.0 |
CPE
Remediation
| |
| zfnd zebrad | < 4.4.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 8, 2026 | Initial Analysis | [email protected] |
| May 8, 2026 | New CVE Received | [email protected] |