Summary
vulnerability in zfnd (CVE-2026-41583). Data can be tampered with by attackers. Exploitable via zcashd.
Original description
The description as published by the source.
CVE-2026-41583: Consensus Divergence in Transparent Sighash Hash-Type Handling
Summary
After a refactoring, Zebra failed to validate a consensus rule that restricted the possible values of sighash hash types for V5 transactions which were enabled in the NU5 network upgrade. Zebra nodes could thus accept and eventually mine a block that would be considered invalid by zcashd nodes, creating a consensus split between Zebra and zcashd nodes.
In a similar vein, for V4 transactions, Zebra mistakenly used the "canonical" hash type when computing the sighash while zcashd (correctly per the spec) uses the raw value, which could also crate a consensus split.
Severity
Critical - This is a Consensus Vulnerability that could allow a malicious party to induce network partitioning, service disruption, and potential double-spend attacks against affected nodes.
Note that the impact is currently alleviated by the fact that currently most miners run zcashd.
Affected Versions
All Zebra versions prior to version 4.3.1. (Some older versions are not impacted but are no longer supported by the network.)
Description
Verification of transparent transactions inherits the Bitcoin Script verification code in C++. Since it is consensus-critical, this code was called from Zebra through foreign function interface (FFI). That interface was clunky because it required parsing the whole transaction in C++ code, which would then pull Rust libraries which could get in conflict with Z…
Source: NIST National Vulnerability Database NVD GitHub Advisory
AI summary
Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.
A critical issue has been found in ZEBRA, a node software for the cryptocurrency Zcash. Systems running this software may experience conflicts between different nodes, leading potentially to network partitioning and loss of transaction integrity. The issue primarily involves differences in how transactions are verified, which could split the network. The solution is to update the software to its latest version to prevent such conflicts.
ZEBRA, a node implementation for Zcash, has been found to inadequately validate consensus rules. Specifically, the validation for sighash hash types in V5 transactions was missing, potentially causing consensus splits between Zebra and zcashd nodes, which could lead to network partitioning. Affected versions are prior to 4.3.1 for zebrad and 5.0.2 for zebra-script. To mitigate this vulnerability, it is essential to upgrade zebra to version 4.3.1 and zebra-script to version 5.0.2 or later.
Consensus rule validation failure in Zcash node ZEBRA, specifically with sighash hash type for V5 transactions.
In Zcash node software ZEBRA, prior to zebrad 4.3.1 and zebra-script 5.0.2.
Critical - potential for network partitioning and double-spend attacks due to consensus splits.
Upgrade zebrad to version 4.3.1 and zebra-script to version 5.0.2.
No workaround available.
Monitor for consensus splits between Zebra and zcashd nodes in the network.
Related past incidents Similar incidents extracted from past CVEs
A consensus failure vulnerability in Bitcoin that caused a network split due to consensus differences in transaction validation.
A vulnerability in Ethereum's Geth client leading to a consensus split due to differences in transaction processing.
A critical vulnerability in Bitcoin leading to consensus failure and the potential for double-spending.
If this happens at your company Expected impact per business scenario
A consensus split could cause transaction verification issues, leading to potential financial discrepancies.
Disruptions and inconsistencies in transaction processing could occur, impacting smart contract operations.
Miners may unknowingly process invalid transactions, leading to financial loss and network instability.
Companies should immediately update their ZEBRA software to the latest secure version to maintain transaction integrity and network stability.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'zfnd' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
zfndを grep し、稼働しているサービス・バージョンを把握する。 -
2Match against affected range verify
Confirm if version satisfies `<4.3.1`Step 1 で見つかったバージョンが影響範囲
<4.3.1に該当するか照合。本番で稼働中ならインシデント扱い。 -
7Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番では Step 3 と同じログクエリでアラート再発が無いか継続監視。
Affected packages
References
- advisory nvd.nist.gov
- package github.com
- web github.com
- web github.com
- web github.com