CVE Intelligence
Analysis AI-assisted

CVE-2026-41583: ZEBRA: Consensus Divergence in Transparent Sighash Hash-Type Handling

ZEBRA, the Zcash node written in Rust, failed after a refactoring to enforce a consensus rule restricting sighash hash types, and used a different hash type value than zcashd for another transaction format. This can make Zebra nodes accept and mine blocks that zcashd nodes consider invalid, causing a consensus split. The record states the issue is fixed in zebrad 4.3.1 and zebra-script 5.0.2, and no confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

ZEBRA is a Zcash node implementation written in Rust. According to the record, a refactoring caused Zebra to stop enforcing a consensus rule that restricts allowed sighash hash-type values for transactions introduced with the NU5 upgrade, and to use the “canonical” hash type for another transaction format where zcashd uses the raw value.

Impact

  • Zebra nodes could accept and eventually mine a block that zcashd nodes consider invalid.
  • This can create a consensus split between Zebra and zcashd nodes.
  • NVD and GitHub scores in the record are both critical (NVD base score 9.1, GitHub score 9.3). The record's vector shows high integrity and availability impact and no confidentiality impact.

Affected products and versions

  • ZcashFoundation Zebra (zebrad) before 4.3.1.
  • zebra-script before 5.0.2.
  • The record lists separate entries for Zfnd Zebrad (before 4.3.1) and Zfnd Zebra-script (before 5.0.2).

Exploitation status

This CVE is not listed in the CISA KEV data in the record. No confirmed exploitation in the wild appears in the sources consulted. The SSVC data in the record reports exploitation as none and automatable as yes. The EPSS probability is 0.00473 with a percentile of 0.39949.

Remediation and mitigation

  • Upgrade zebrad to version 4.3.1 or later.
  • Upgrade zebra-script to version 5.0.2 or later wherever it is used.
  • Review the GitHub security advisory for vendor guidance.
  • Until patched, treat node chain views with caution and compare them with other independent nodes.

Detection guidance

  • Inventory Zebra deployments and their versions, including any embedded use of zebra-script.
  • Watch for blocks or chain tips rejected by zcashd-based peers, which may indicate divergence.
  • Alert when a node persistently disagrees with the majority of the network.

Limitations of the available information

  • The record's fixes list is empty; the fixed versions come from the description and the advisory reference.
  • The record gives CWE-573 without a name.
  • The record does not describe block heights, whether any invalid block reached the live network, or additional trigger conditions.
  • Scores from different providers differ and should be read with their vector context.

Frequently asked questions

What is the core problem in CVE-2026-41583?

Zebra stopped enforcing a consensus rule on sighash hash types after a refactoring, so it can accept blocks that zcashd considers invalid, creating a consensus split.

Which versions are fixed?

The description states the issue is patched in zebrad 4.3.1 and zebra-script 5.0.2. The record's fixes list is empty, so check the vendor advisory for details.

Is this CVE known to be exploited?

It is not listed in the KEV data in the record, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.