PT-2026-37129 · Unknown+1 · Zebra-Script+1

Sangsoo-Osec

·

Published

2026-04-18

·

Updated

2026-05-14

·

CVE-2026-41583

CVSS v4.0

9.3

Critical

VectorAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H
Name of the Vulnerable Software and Affected Versions zebrad versions prior to 4.3.1 zebra-script versions prior to 5.0.2
Description Following a refactoring of the verification process for transparent transactions, Zebra failed to validate a consensus rule restricting the possible values of sighash hash types for V5 transactions enabled in the NU5 network upgrade. Additionally, for V4 transactions, Zebra incorrectly used the canonical hash type when computing the sighash instead of the raw value. These issues could allow an attacker to submit transactions with invalid hash types, leading Zebra nodes to accept and potentially mine blocks that zcashd nodes would consider invalid, resulting in a consensus split and network partitioning.
Recommendations Update zebrad to version 4.3.1 or later. Update zebra-script to version 5.0.2 or later.

Fix

Weakness Enumeration

CWE-573

Related Identifiers

CVE-2026-41583
GHSA-8M29-FPQ5-89JJ

Affected Products

Zebra-Script
Zebrad