CVE-2026-41583: ZEBRA: Consensus Divergence in Transparent Sighash Hash-Type Handling
ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.1 and prior to zebra-script version 5.0.2, after a refactoring, Zebra failed to validate a consensus rule that restricted the possible values of sighash hash types for V5 transactions which were enabled in the NU5 network upgrade. Zebra nodes could thus accept and eventually mine a block that would be considered invalid by zcashd nodes, creating a consensus split between Zebra and zcashd nodes. In a similar vein, for V4 transactions, Zebra mistakenly used the "canonical" hash type when computing the sighash while zcashd (correctly per the spec) uses the raw value, which could also crate a consensus split. This issue has been patched in zebrad version 4.3.1 and zebra-script version 5.0.2.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41583?
CVE-2026-41583 has been classified with a medium severity level due to its potential impact on the consensus rules in ZEBRA.
How do I fix CVE-2026-41583?
To remediate CVE-2026-41583, upgrade to zebrad version 4.3.1 or higher and zebra-script version 5.0.2 or higher.
What applications are affected by CVE-2026-41583?
CVE-2026-41583 affects the ZEBRA software, specifically zebrad versions prior to 4.3.1 and zebra-script versions prior to 5.0.2.
What is the impact of exploiting CVE-2026-41583?
Exploiting CVE-2026-41583 could lead to consensus divergence, potentially compromising transaction validity within the Zcash network.
When was CVE-2026-41583 disclosed?
CVE-2026-41583 was disclosed as part of a security advisory related to ZEBRA, which was made public on its GitHub repository.