CVE-2026-41583
Zebra Vulnerable to Consensus Divergence in Transparent Sighash Hash-Type Handling
Impact
ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.1 and prior to zebra-script version 5.0.2, after a refactoring, Zebra failed to validate a consensus rule that restricted the possible values of sighash hash types for V5 transactions which were enabled in the NU5 network upgrade. Zebra nodes could thus accept and eventually mine a block that would be considered invalid by zcashd nodes, creating a consensus split between Zebra and zcashd nodes. In a similar vein, for V4 transactions, Zebra mistakenly used the "canonical" hash type when computing the sighash while zcashd (correctly per the spec) uses the raw value, which could also crate a consensus split. This issue has been patched in zebrad version 4.3.1 and zebra-script version 5.0.2.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rust | zebrad | < 4.3.1 | 4.3.1 |
| rust | zebra-script | < 5.0.2 | 5.0.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Zfnd | Zebra-Script | before 5.0.2 |
| Zfnd | Zebrad | before 4.3.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-8m29-fpq5-89jj
- https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-8m29-fpq5-89jj
- https://github.com/ZcashFoundation/zebra/commit/1f605eca5c55e3b65229fa01a97d9aa84fd37447
- https://nvd.nist.gov/vuln/detail/CVE-2026-41583