GHSA-jv4h-j224-23cc CVE-2026-44498

Zebra's Block Validator Undercounts Coinbase and P2SH Sigops

High crates.io

Severity: 0.0 / 10; High · CVSS 4.0
Exploit chance (EPSS): 0.28%; Chance of exploitation in the next 30 days. Higher than 20.84% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-682 Incorrect Calculation
Fix: 4.4.0; Upgrade zebrad to this version or later

Description

Zebra's block validator undercounts transparent signature operations against the 20000-sigop block limit (MAX_BLOCK_SIGOPS), allowing it to accept blocks that zcashd rejects with bad-blk-sigops. A miner who produces such a block can split the network: Zebra nodes follow the offending chain while zcashd nodes do not.

Two distinct undercounts:

A: Coinbase Hidden Legacy Sigops

zcashd's GetLegacySigOpCount() includes the coinbase input's scriptSig. Zebra's Sigops impl skipped the coinbase input entirely, so up to ~98 sigops (the 100-byte coinbase script length cap, less the height prefix) could be hidden inside the coinbase scriptSig without being charged against the block limit.

B: Aggregate P2SH Sigops.

zcashd's GetP2SHSigOpCount() parses each P2SH input's redeem script with accurate=true and sums those sigops into the block-wide total via ConnectBlock. The check is per-block, not per-transaction, and the limit applies regardless of who mines the offending block — a miner just needs to include enough P2SH-spending transactions whose redeem scripts together exceed 20000 sigops. Zebra computed P2SH sigops only on the mempool-acceptance path (used for ZIP-317 weighting) and never accumulated them during block validation. A block whose aggregate redeem-script sigops exceed 20000 (e.g. 1334 P2SH spends × 15 sigops = 20010) would be accepted by Zebra and rejected by zcashd.

Patches

Fixed in this release: https://github.com/ZcashFoundation/zebra/releases/tag/v4.4.0.

Workarounds

None. Operators relying on Zebra for consensus should upgrade.

Resources

MAX_BLOCK_SIGOPS constant inherited from Bitcoin via the Zcash protocol spec's §7.6 catch-all "Other rules inherited from Bitcoin", tracked for explicit documentation in zcash/zips#568.
zcashd GetLegacySigOpCount: https://github.com/zcash/zcash/blob/v6.11.0/src/main.cpp#L826-L836
zcashd GetP2SHSigOpCount: https://github.com/zcash/zcash/blob/v6.11.0/src/main.cpp#L840-L852
zcashd ConnectBlock aggregates per-tx sigops and compares against MAX_BLOCK_SIGOPS.

Affected versions

crates.io

Package	Vulnerable	Fixed in
zebrad	`< 4.4.0`	`4.4.0`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

zebrad crates.io → `4.4.0`

cargo

cargo update -p zebrad --precise 4.4.0

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: None
User interaction: None
Confidentiality (vulnerable system): None
Integrity (vulnerable system): High
Availability (vulnerable system): None
Confidentiality (subsequent systems): None
Integrity (subsequent systems): High
Availability (subsequent systems): None

CVSS 3.1 7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: High
Availability: None

Weakness

CWE-682: Incorrect Calculation

The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.

How to prevent it

Implementation: Understand your programming language's underlying representation and how it interacts with numeric calculation. Pay close attention to byte size discrepancies, precision, signed/unsigned distinctions, truncation, conversion and casting between types, "not-a-number" calculations, and how your language handles numbers that are too large or too small for its underlying representation.
Implementation: Perform input validation on any numeric input by ensuring that it is within the expected range. Enforce that the input meets both the minimum and maximum requirements for the expected range.
Implementation: Use the appropriate type for the desired action. For example, in C/C++, only use unsigned types for values that could never be negative, such as height, width, or other numbers related to quantity.
Architecture and Design: Use languages, libraries, or frameworks that make it easier to handle numbers without unexpected consequences. Examples include safe integer handling packages such as SafeInt (C++) or IntegerLib (C or C++).
Architecture and Design: Use languages, libraries, or frameworks that make it easier to handle numbers without unexpected consequences. Examples include safe integer handling packages such as SafeInt (C++) or IntegerLib (C or C++).
Implementation: Examine compiler warnings closely and eliminate problems with potential security implications, such as signed / unsigned mismatch in memory operations, or use of uninitialized variables. Even if the weakness is rarely exploitable, a single failure may lead to the compromise of the entire system.

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2026-44498

Packages

github.com/ZcashFoundation/zebra

Timeline

May 7, 2026 Published
Jun 17, 2026 Last updated by the source
Nov 1, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-ww9q-8r59-xv46 Zebra: Missing copy constraint in halo2_gadgets variable-base scalar multiplication allows under-constrained base, breaking Orchard Action circuit soundness	Critical	Also affects zebrad
GHSA-63wg-wjjj-7cp8 Zebra Address Book Aborted by IPv4-Mapped Mempool Misbehavior Update	High	Also affects zebrad
GHSA-65jj-fmw8-468q zebrad has unbounded memory leak in mempool download pipeline via timeout path cancel_handles retention	Medium	Also affects zebrad
GHSA-2gf8-q9rr-jq3h zebrad has persistent on-disk corruption of Sapling/Orchard subtree roots after chain fork via pop_tip	Medium	Also affects zebrad
GHSA-hhm7-qrv5-h4r6 Zebra: Repeated Non-Finalized Shielded Transaction Aborts Zebra Before Duplicate-Nullifier Rejection	Medium	Also affects zebrad
GHSA-w834-cf6p-9m9w Zebra: Finalized address balance credit-first overflow on consensus-valid blocks	Medium	Also affects zebrad
GHSA-gvjc-3w7c-92jx Zebra has sync restart poisoning from single unauthenticated peer via above-lookahead block	Medium	Also affects zebrad
GHSA-gf9r-m956-97qx zebrad has consensus divergence via P2SH sigop undercount in pure-Rust disabled-opcode parser	Critical	Also affects zebrad

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor