# CVE-2026-41583: Zcash Foundation Zebra consensus divergence in sighash handling

Source: https://junglewise.ai/threats/cve-2026-41583-zcash-foundation-zebra-consensus-divergence-in-sighash-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-08. Updated: 2026-05-12  
License: CC BY 4.0 with a link back

CVE-2026-41583 · Severity: critical · CVSS 9.1 · Published 2026-05-08

Zebra, a software implementation of the Zcash cryptocurrency node, contains a flaw in how it validates transaction signatures. This vulnerability allows a malicious actor to submit specially crafted transactions that Zebra nodes accept but other Zcash nodes (like zcashd) reject. This can lead to a 'consensus split,' effectively splitting the network into two different versions of history, which could disrupt services and potentially allow for double-spend attacks.

Technologies: [zebra-script (crates.io)](https://junglewise.ai/threats/technologies/zebra-script), [zebrad (crates.io)](https://junglewise.ai/threats/technologies/zebrad), [Zfnd Zebrad](https://junglewise.ai/threats/technologies/zfnd-zebrad). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io), [Zfnd](https://junglewise.ai/threats/vendors/zfnd).

## Quick answers

**Is CVE-2026-41583 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41583 being exploited in the wild.

**How severe is CVE-2026-41583?** Critical severity, with a CVSS score of 9.1, published 8 May 2026.

**Which products and versions are affected?** zebra-script (crates.io) < 5.0.2, SEMVER:introduced=0,fixed=5.0.2; zebrad (crates.io) < 4.3.1, SEMVER:introduced=0,fixed=4.3.1.

**Is there a fix for CVE-2026-41583?** Yes. zebra-script (crates.io): upgrade to 5.0.2 or later; zebrad (crates.io): upgrade to 4.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41583 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-41583?** Check whether you run zebra-script (crates.io), zebrad (crates.io), Zfnd Zebra-Script or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- zebra-script (crates.io): upgrade to 5.0.2 or later

  ```sh
  cargo update -p zebra-script
  ```

- zebrad (crates.io): upgrade to 4.3.1 or later

  ```sh
  cargo update -p zebrad
  ```


## Technical details

A refactoring of the Zebra transaction verification logic moved consensus-critical checks from C++ to Rust but failed to re-implement a rule restricting sighash hash types for V5 transactions. Additionally, Zebra incorrectly used canonical hash types for V4 transactions instead of raw values as required by the Zcash specification. An attacker can exploit these discrepancies by submitting transactions with invalid hash types, causing Zebra nodes to accept blocks that the rest of the network (running zcashd) considers invalid. This results in a consensus split and network partitioning. The issue is fixed in zebrad 4.3.1 and zebra-script 5.0.2.

## Affected products

- Zcash Foundation zebrad < 4.3.1
- Zcash Foundation zebra-script < 5.0.2

## Identifiers

- CVE-2026-41583
- GHSA-8m29-fpq5-89jj

## Timeline

- 2026-04-18: advisory: GitHub Advisory published
- 2026-04-18: patched: Fix released in version 4.3.1

## References

- [https://api.github.com/users/conradoplg](https://api.github.com/users/conradoplg)
- [https://github.com/conradoplg](https://github.com/conradoplg)
- [https://api.github.com/users/conradoplg/gists%7B/gist_id%7D](https://api.github.com/users/conradoplg/gists%7B/gist_id%7D)
- [https://api.github.com/users/conradoplg/repos](https://api.github.com/users/conradoplg/repos)
- [https://avatars.githubusercontent.com/u/35766?v=4](https://avatars.githubusercontent.com/u/35766?v=4)
- [https://api.github.com/users/conradoplg/events%7B/privacy%7D](https://api.github.com/users/conradoplg/events%7B/privacy%7D)

## Related threats

- [ZcashFoundation Zebra assertion panic in address book mempool update](https://junglewise.ai/threats/cve-2026-52829-zcashfoundation-zebra-assertion-panic-in-address-book-mempool)
- [ZcashFoundation Zebra process abort via repeated shielded transactions](https://junglewise.ai/threats/cve-2026-52739-zcashfoundation-zebra-process-abort-via-repeated-shielded)
- [ZcashFoundation Zebra denial of service via balance overflow in state writer](https://junglewise.ai/threats/cve-2026-52738-zcashfoundation-zebra-denial-of-service-via-balance-overflow-in)
- [Zcash Zebra sync restart poisoning via above-lookahead block](https://junglewise.ai/threats/cve-2026-52737-zcash-zebra-sync-restart-poisoning-via-above-lookahead-block)
- [ZcashFoundation Zebra block suppression via same-header body poisoning](https://junglewise.ai/threats/cve-2026-52736-zcashfoundation-zebra-block-suppression-via-same-header-body)