NVD Vulnerability Detail
Search Exploit, PoC
CVE-2026-44497
Summary

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.4.0 and prior to zebra-script version 6.0.0, the fix for CVE-2026-41583 introduced a separate issue due to insufficient error handling of the case where the sighash type is invalid, during sighash computation. Instead of returning an error, the normal flow would resume, and the input sighash buffer would be left untouched. In scenarios where a previous signature validation could leave a valid sighash in the buffer, an invalid hash-type could be incorrectly accepted, which would create a consensus split between Zebra and zcashd nodes. This issue has been patched in zebrad version 4.4.0 and zebra-script version 6.0.0.

Publication Date May 9, 2026, 12:17 a.m.
Registration Date May 9, 2026, 4:15 a.m.
Last Update May 9, 2026, 3:42 a.m.
CVSS3.1 : CRITICAL
スコア 9.1
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
攻撃元区分(AV) ネットワーク
攻撃条件の複雑さ(AC)
攻撃に必要な特権レベル(PR) 不要
利用者の関与(UI) 不要
影響の想定範囲(S) 変更なし
機密性への影響(C) なし
完全性への影響(I)
可用性への影響(A)
Affected software configurations
Configuration1 or higher or less more than less than
cpe:2.3:a:zfnd:zebra-script:*:*:*:*:*:rust:*:* 6.0.0
cpe:2.3:a:zfnd:zebrad:*:*:*:*:*:rust:*:* 4.4.0
Related information, measures and tools
Common Vulnerabilities List