CVE-2026-41583: Zcash Foundation Zebra consensus divergence in sighash handling

CVE-2026-41583 · Severity: critical · CVSS 9.1 · Published 2026-05-08

Zebra, a software implementation of the Zcash cryptocurrency node, contains a flaw in how it validates transaction signatures. This vulnerability allows a malicious actor to submit specially crafted transactions that Zebra nodes accept but other Zcash nodes (like zcashd) reject. This can lead to a 'consensus split,' effectively splitting the network into two different versions of history, which could disrupt services and potentially allow for double-spend attacks.

Technologies: zebra-script (crates.io), zebrad (crates.io), Zfnd Zebrad. Vendors: crates.io, Zfnd.

Quick answers

Is CVE-2026-41583 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-41583 being exploited in the wild.
How severe is CVE-2026-41583?
Critical severity, with a CVSS score of 9.1, published 8 May 2026.
Which products and versions are affected?
zebra-script (crates.io) < 5.0.2, SEMVER:introduced=0,fixed=5.0.2; zebrad (crates.io) < 4.3.1, SEMVER:introduced=0,fixed=4.3.1.
Is there a fix for CVE-2026-41583?
Yes. zebra-script (crates.io): upgrade to 5.0.2 or later; zebrad (crates.io): upgrade to 4.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41583 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-41583?
Check whether you run zebra-script (crates.io), zebrad (crates.io), Zfnd Zebra-Script or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • zebra-script (crates.io): upgrade to 5.0.2 or later
    cargo update -p zebra-script
  • zebrad (crates.io): upgrade to 4.3.1 or later
    cargo update -p zebrad

Technical details

A refactoring of the Zebra transaction verification logic moved consensus-critical checks from C++ to Rust but failed to re-implement a rule restricting sighash hash types for V5 transactions. Additionally, Zebra incorrectly used canonical hash types for V4 transactions instead of raw values as required by the Zcash specification. An attacker can exploit these discrepancies by submitting transactions with invalid hash types, causing Zebra nodes to accept blocks that the rest of the network (running zcashd) considers invalid. This results in a consensus split and network partitioning. The issue is fixed in zebrad 4.3.1 and zebra-script 5.0.2.

Affected products

  • Zcash Foundation zebrad < 4.3.1
  • Zcash Foundation zebra-script < 5.0.2

Identifiers

  • CVE-2026-41583
  • GHSA-8m29-fpq5-89jj

Timeline

  • 2026-04-18: advisory: GitHub Advisory published
  • 2026-04-18: patched: Fix released in version 4.3.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.