Summary

vulnerability in zfnd (CVE-2026-44497). Data can be tampered with by attackers. Exploitable via zcashd. Mitigation: upgrade to 4.4.0 or later.

Original description

The description as published by the source.

CVE-2026-44497: Consensus Divergence in Transparent Sighash Hash-Type Handling due to Stale Buffer

Summary

The fix for https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-8m29-fpq5-89jj introduced a separate issue due to insuficient error handling of the case where the sighash type is invalid, during sighash computation. Instead of returning an error, the normal flow would resume, and the input sighash buffer would be left untouched. In scenarios where a previous signature validation could leave a valid sighash in the buffer, an invalid hash-type could be incorrectly accepted, which would create a consensus split between Zebra and zcashd nodes.

Severity

Critical - This is a Consensus Vulnerability that could allow a malicious party to induce network partitioning, service disruption, and potential double-spend attacks against affected nodes.

Note that the impact is currently alleviated by the fact that currently most miners run zcashd.

Affected Versions

Zebra 4.3.1.

Description

Verification of transparent transactions inherits the Bitcoin Script verification code in C++, called from Zebra through a foreign function interface (FFI) with a Rust callback that computes the sighash. The fix for https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-8m29-fpq5-89jj added the missing V5 hash-type consensus check on the Rust side, returning None for undefined hash types. However, the FFI bridge only writes to the C++ sighash buff…

Source: NIST National Vulnerability Database NVD GitHub Advisory

AI summary

Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.

Zebra is software for managing Zcash nodes, and an issue in its older versions can improperly handle certain transaction forms, risking network partition. This can lead to transaction stoppages or fraudulent transactions. It's fixed in the latest versions; therefore, prompt software updates are recommended.

In older versions of ZEBRA, the mishandling of invalid hash types during sighash computation leads to a potential consensus split. The issue is addressed by updating to zebrad 4.4.0 and zebra-script 6.0.0, where the buffer is filled with random bytes on validation failure to force the expected signature validation failure.

❓ What is the problem

Insufficient error handling of invalid sighash type in Zcash node software Zebra.

📍 Affected scope

During sighash computation in older versions of ZEBRA prior to zebrad 4.4.0 and zebra-script 6.0.0.

🔥 Severity

Critical, allowing network partitioning and potential double-spend attacks.

🔧 How to fix

Upgrade to zebrad version 4.4.0 and zebra-script version 6.0.0.

🛡️ Workaround

No existing workarounds; immediate upgrade is required.

🔍 Detection

Monitor consensus splits between Zebra and zcashd nodes.

Related past incidents Similar incidents extracted from past CVEs

CVE-2026-41583

Initial fix that introduced insufficient error handling, leading to the separate issue in CVE-2026-44497.

Heartbleed

Similar in theme to handling errors that can lead to unintended exposures.

If this happens at your company Expected impact per business scenario

📌 ブロックチェーン金融システムにおける場合

取引が停止し、二重支払いのリスクが高まる可能性があります。

📌 暗号通貨取引所での採用

ネットワークの分断によって顧客資産の安全性が脅かされ、信頼が損なわれる可能性があります。

📌 ZcashのマイナーがZebraを使用する場合

コンセンサス分裂により不正確なブロック承認が発生する可能性があります。

Recommended action

zebradとzebra-scriptのクライアントを直ちにアップデートすることが重要です。

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

1
Identify exposure identify
```
grep -r 'zfnd' . | grep -v node_modules
```
リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で zfnd を grep し、稼働しているサービス・バージョンを把握する。
6
Apply patch patch
```
Upgrade zfnd to 4.4.0
```
ステージング環境で 4.4.0 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスと、Step 3 で見つけた異常検知の続報チェックを含めること。
7
Post-deployment verification verify
```
Confirm patched version is live in production
```
パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番では Step 3 と同じログクエリでアラート再発が無いか継続監視。

Affected packages

rust zebra-script

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.0"}]}]

rust zebrad

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0"}]}]

crates.io zebra-script

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.0.0"}]}]

crates.io zebrad

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.4.0"}]}]

References

advisory nvd.nist.gov
package github.com
web github.com
web github.com
web github.com