CVE-2026-104430: Function Call with Incorrectly Specified Arguments in ZcashFoundation zebra
Zebra zebrad 4.5.0 and zebra-script 7.0.0 count P2SH redeem script signature operations in legacy mode rather than zcashd's accurate P2SH mode, overcounting CHECKMULTISIG preceded by OP_1 through OP_16 as 20 sigops and causing a consensus divergence. Remote attackers can broadcast P2SH spends using low-threshold multisig redeem scripts so that a block zcashd accepts exceeds Zebra's inflated MAX_BLOCK_SIGOPS count, causing Zebra nodes to reject it and stall off the chain.
AI Analysis
Technical Summary
Zebra zebrad 4.5.0 and zebra-script 7.0.0 incorrectly count P2SH redeem script signature operations in legacy mode rather than using zcashd's accurate P2SH mode. Specifically, CHECKMULTISIG preceded by OP_1 through OP_16 is overcounted as 20 signature operations instead of the correct count. This discrepancy causes Zebra nodes to reject blocks that zcashd accepts because the blocks exceed Zebra's inflated MAX_BLOCK_SIGOPS limit, leading to consensus divergence and node stalls off the chain. The vulnerability allows remote attackers to broadcast P2SH spends using low-threshold multisig redeem scripts to trigger this behavior.
Potential Impact
The impact is a consensus divergence between Zebra nodes and zcashd nodes due to Zebra's overcounting of signature operations in P2SH multisig scripts. This causes Zebra nodes to reject blocks that zcashd accepts, leading to stalled Zebra nodes and potential disruption of network participation. There is no indication of direct compromise or data loss, but network reliability and consensus integrity are affected.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, operators should monitor Zebra node behavior for stalls and consider coordinating with the ZcashFoundation for updates. No vendor advisory or patch links are provided in the input data.
CVE-2026-104430: Function Call with Incorrectly Specified Arguments in ZcashFoundation zebra
Description
Zebra zebrad 4.5.0 and zebra-script 7.0.0 count P2SH redeem script signature operations in legacy mode rather than zcashd's accurate P2SH mode, overcounting CHECKMULTISIG preceded by OP_1 through OP_16 as 20 sigops and causing a consensus divergence. Remote attackers can broadcast P2SH spends using low-threshold multisig redeem scripts so that a block zcashd accepts exceeds Zebra's inflated MAX_BLOCK_SIGOPS count, causing Zebra nodes to reject it and stall off the chain.
CVSS v4.0
Score 8.7high
Affected software
ZcashFoundation
zebra
ZcashFoundation
zebra
pkg:github/zcashfoundation/zebraRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Zebra zebrad 4.5.0 and zebra-script 7.0.0 incorrectly count P2SH redeem script signature operations in legacy mode rather than using zcashd's accurate P2SH mode. Specifically, CHECKMULTISIG preceded by OP_1 through OP_16 is overcounted as 20 signature operations instead of the correct count. This discrepancy causes Zebra nodes to reject blocks that zcashd accepts because the blocks exceed Zebra's inflated MAX_BLOCK_SIGOPS limit, leading to consensus divergence and node stalls off the chain. The vulnerability allows remote attackers to broadcast P2SH spends using low-threshold multisig redeem scripts to trigger this behavior.
Potential Impact
The impact is a consensus divergence between Zebra nodes and zcashd nodes due to Zebra's overcounting of signature operations in P2SH multisig scripts. This causes Zebra nodes to reject blocks that zcashd accepts, leading to stalled Zebra nodes and potential disruption of network participation. There is no indication of direct compromise or data loss, but network reliability and consensus integrity are affected.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, operators should monitor Zebra node behavior for stalls and consider coordinating with the ZcashFoundation for updates. No vendor advisory or patch links are provided in the input data.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-02T00:50:26.603Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6abf99b0a43b0b3b89b26944
Added to database: 10/02/2026, 11:46:56 UTC
Last enriched: 10/02/2026, 12:02:19 UTC
Last updated: 10/03/2026, 03:10:06 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.