Critical severity · published May 8, 2026
CVE-2026-44497
ZEBRA: Consensus Divergence in Transparent Sighash Hash-Type Handling due to Stale Buffer
9.1
CVSS
0.2%
EPSS
No
On KEV
Description
ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.4.0 and prior to zebra-script version 6.0.0, the fix for CVE-2026-41583 introduced a separate issue due to insufficient error handling of the case where the sighash type is invalid, during sighash computation. Instead of returning an error, the normal flow would resume, and the input sighash buffer would be left untouched. In scenarios where a previous signature validation could leave a valid sighash in the buffer, an invalid hash-type could be incorrectly accepted, which would create a consensus split between Zebra and zcashd nodes. This issue has been patched in zebrad version 4.4.0 and zebra-script version 6.0.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZE
zebra · ZcashFoundation
zebra-script < 6.0.0; zebrad < 4.4.0 · source: vendor
ZE
Zebra-script · Zfnd
before 6.0.0 · source: NVD
ZE
Zebrad · Zfnd
before 4.4.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-44497
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-44497
Vendor Advisory
https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-gq4h-3grw-2rhv
More from zebra
9.3
CVE-2026-52735
ZEBRA: Consensus divergence via P2SH sigop undercount in pure-Rust disabled-opcode parser
9.3
CVE-2026-54496
Missing copy constraint in halo2_gadgets variable-base scalar multiplication allows under-constrained base, breaking Orchard Action circuit soundness
9.1
CVE-2026-41583
ZEBRA: Consensus Divergence in Transparent Sighash Hash-Type Handling
8.7
CVE-2026-52736
ZEBRA: Block suppression via NU5 same-header body poisoning of sent-hash cache
8.7
CVE-2026-44499
ZEBRA: Permanent Block Discovery Halt via Gossip Queue Saturation and Syncer Poisoning
