CVE-2026-41583
Published: 08 May 2026
Summary
CVE-2026-41583 is a critical-severity Improper Following of Specification by Caller (CWE-573) vulnerability in Zfnd Zebra-Script. Its CVSS base score is 9.1 (Critical).
Operationally, ranked at the 15.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
NVD Description
ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.1 and prior to zebra-script version 5.0.2, after a refactoring, Zebra failed to validate a consensus rule that restricted the possible values of sighash hash types for…
more
V5 transactions which were enabled in the NU5 network upgrade. Zebra nodes could thus accept and eventually mine a block that would be considered invalid by zcashd nodes, creating a consensus split between Zebra and zcashd nodes. In a similar vein, for V4 transactions, Zebra mistakenly used the "canonical" hash type when computing the sighash while zcashd (correctly per the spec) uses the raw value, which could also crate a consensus split. This issue has been patched in zebrad version 4.3.1 and zebra-script version 5.0.2.
Deeper analysisAI
Automated synthesis unavailable for this CVE.
Details
- CWE(s)