EUVD-2026-309234

fkie_cve-2026-41583

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.1 and prior to zebra-script version 5.0.2, after a refactoring, Zebra failed to validate a consensus rule that restricted the possible values of sighash hash types for V5 transactions which were enabled in the NU5 network upgrade. Zebra nodes could thus accept and eventually mine a block that would be considered invalid by zcashd nodes, creating a consensus split between Zebra and zcashd nodes. In a similar vein, for V4 transactions, Zebra mistakenly used the "canonical" hash type when computing the sighash while zcashd (correctly per the spec) uses the raw value, which could also crate a consensus split. This issue has been patched in zebrad version 4.3.1 and zebra-script version 5.0.2.

GHSA-8m29-fpq5-89jj — Zebra Vulnerable to Consensus Divergence in Transparent Sighash Hash-Type Handling

Affected: crates.io: zebrad, crates.io: zebra-script

# CVE-2026-41583: Consensus Divergence in Transparent Sighash Hash-Type Handling

## Summary

After a refactoring, Zebra failed to validate a consensus rule that restricted the possible values of sighash hash types for V5 transactions which were enabled in the NU5 network upgrade. Zebra nodes could thus accept and eventually mine a block that would be considered invalid by zcashd nodes, creating a consensus split between Zebra and zcashd nodes.

In a similar vein, for V4 transactions, Zebra mistakenly used the "canonical" hash type when computing the sighash while zcashd (correctly per the spec) uses the raw value, which could also crate a consensus split.

## Severity

**Critical** - This is a Consensus Vulnerability that could allow a malicious party to induce network partitioning, service disruption, and potential double-spend attacks against affected nodes.

Note that the impact is currently alleviated by the fact that currently most miners run `zcashd`.

## Affected Versions

All Zebra versions prior to version 4.3.1. (Some older versions are not impacted but are no longer supported by the network.)

## Description

Verification of transparent transactions inherits the Bitcoin Script verification code in C++. Since it is consensus-critical, this code was called from Zebra through foreign function interface (FFI). That interface was clunky because it required parsing the whole transaction in C++ code, which would then pull Rust libraries which could get in conflict with…

Most recent entries from all

EUVD-2026-309234

fkie_cve-2026-41583

GHSA-8m29-fpq5-89jj — Zebra Vulnerable to Consensus Divergence in Transparent Sighash Hash-Type Handling