CVE-2026-44498: CWE-682: Incorrect Calculation in ZcashFoundation zebra
ZEBRA is a Zcash node written entirely in Rust. Prior to version 4.4.0, Zebra's block validator undercounts transparent signature operations against the 20000-sigop block limit (MAX_BLOCK_SIGOPS), allowing it to accept blocks that zcashd rejects with bad-blk-sigops. A miner who produces such a block can split the network: Zebra nodes follow the offending chain while zcashd nodes do not. This issue has been patched in version 4.4.0.
AI Analysis
Technical Summary
CVE-2026-44498 describes an incorrect calculation vulnerability (CWE-682) in Zebra's block validator before version 4.4.0. The validator undercounts transparent signature operations relative to the 20000-sigop block limit (MAX_BLOCK_SIGOPS), enabling acceptance of blocks that violate consensus rules enforced by zcashd. This discrepancy can lead to a consensus split between Zebra and zcashd nodes. The vulnerability has been addressed in Zebra 4.4.0.
Potential Impact
The vulnerability allows a miner to produce blocks that Zebra nodes accept but zcashd nodes reject, potentially causing a network split and undermining consensus integrity. This can disrupt network stability and trust in block validation consistency across different node implementations.
Mitigation Recommendations
Upgrade Zebra to version 4.4.0 or later, where this vulnerability is patched. No other mitigation is indicated or necessary as the fix is available in the official release.
CVE-2026-44498: CWE-682: Incorrect Calculation in ZcashFoundation zebra
Description
ZEBRA is a Zcash node written entirely in Rust. Prior to version 4.4.0, Zebra's block validator undercounts transparent signature operations against the 20000-sigop block limit (MAX_BLOCK_SIGOPS), allowing it to accept blocks that zcashd rejects with bad-blk-sigops. A miner who produces such a block can split the network: Zebra nodes follow the offending chain while zcashd nodes do not. This issue has been patched in version 4.4.0.
CVSS v4.0
Score 9.2critical
Affected software
pkg:cargo/github/ZcashFoundation/zebraRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-44498 describes an incorrect calculation vulnerability (CWE-682) in Zebra's block validator before version 4.4.0. The validator undercounts transparent signature operations relative to the 20000-sigop block limit (MAX_BLOCK_SIGOPS), enabling acceptance of blocks that violate consensus rules enforced by zcashd. This discrepancy can lead to a consensus split between Zebra and zcashd nodes. The vulnerability has been addressed in Zebra 4.4.0.
Potential Impact
The vulnerability allows a miner to produce blocks that Zebra nodes accept but zcashd nodes reject, potentially causing a network split and undermining consensus integrity. This can disrupt network stability and trust in block validation consistency across different node implementations.
Mitigation Recommendations
Upgrade Zebra to version 4.4.0 or later, where this vulnerability is patched. No other mitigation is indicated or necessary as the fix is available in the official release.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-06T18:28:20.886Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69fdff95cbff5d8610e6d709
Added to database: 05/08/2026, 15:21:57 UTC
Last enriched: 05/16/2026, 09:26:37 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 140
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.