CVE-2026-44497

The record

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.4.0 and prior to zebra-script version 6.0.0, the fix for CVE-2026-41583 introduced a separate issue due to insufficient error handling of the case where the sighash type is invalid, during sighash computation. Instead of returning an error, the normal flow would resume, and the input sighash buffer would be left untouched. In scenarios where a previous signature validation could leave a valid sighash in the buffer, an invalid hash-type could be incorrectly accepted, which would create a consensus split between Zebra and zcashd nodes. This issue has been patched in zebrad version 4.4.0 and zebra-script version 6.0.0.

Affected packages

Related vulnerabilities

• GHSA-gq4h-3grw-2rhv Zebra has Consensus Divergence in Transparent Sighash Hash-Type Handling due to Stale… Same vulnerability
• GHSA-pvmv-cwg8-v6c8 Zebra v4.4.0 still accepts V5 SIGHASH_SINGLE without a corresponding output Also affects zebra-script
• CVE-2026-41583 ZEBRA is a Zcash node written entirely in Rust. Also affects zebra-script
• GHSA-8m29-fpq5-89jj Zebra Vulnerable to Consensus Divergence in Transparent Sighash Hash-Type Handling Also affects zebra-script
• GHSA-h9hm-m2xj-4rq9 Zebra has Permanent Block Discovery Halt via Gossip Queue Saturation and Syncer Poisoning Also affects zebrad
• CVE-2026-44499 ZEBRA is a Zcash node written entirely in Rust. Also affects zebrad
• CVE-2026-44498 ZEBRA is a Zcash node written entirely in Rust. Also affects zebrad
• CVE-2026-44500 ZEBRA is a Zcash node written entirely in Rust. Also affects zebrad