PT-2026-38619 · Zebra+1 · Zebra+1

Defuse + 1 · Published 2026-05-07 · Updated 2026-05-08 · CVE-2026-44498

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions ZEBRA versions prior to 4.4.0

Description The block validator undercounts transparent signature operations against the 20000-sigop block limit MAX BLOCK SIGOPS, which allows the software to accept blocks that zcashd rejects. This discrepancy can enable a miner to split the network, as Zebra nodes would follow a chain that zcashd nodes reject. The issue stems from two undercounting errors: first, the Sigops implementation skipped the coinbase input entirely, allowing up to approximately 98 sigops to be hidden in the coinbase scriptSig. Second, Zebra failed to accumulate P2SH sigops during block validation, only computing them during the mempool-acceptance path. Consequently, blocks where the aggregate redeem-script sigops exceed 20000 are incorrectly accepted.

Recommendations Update to version 4.4.0.

Fix

Weakness Enumeration

CWE-682

Related Identifiers

CVE-2026-44498

GHSA-JV4H-J224-23CC

Affected Products

Zebra

Zcashd

References · 7

• https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-jv4h-j224-23cc · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jv4h-j224-23cc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44498 · Security Note
• https://github.com/ZcashFoundation/zebra · Note
• https://github.com/ZcashFoundation/zebra/releases/tag/v4.4.0 · Note
• https://t.me/CVEtracker/53125 · Telegram Post
• https://twitter.com/CVEnew/status/2052810981781217646 · Twitter Post