{"id":"CVE-2026-44498","aliases":["EUVD-2026-28783","GHSA-jv4h-j224-23cc"],"status":"published","title":"ZEBRA: Block Validator Undercounts Coinbase and P2SH Sigops","description":"ZEBRA is a Zcash node written entirely in Rust. Prior to version 4.4.0, Zebra's block validator undercounts transparent signature operations against the 20000-sigop block limit (MAX_BLOCK_SIGOPS), allowing it to accept blocks that zcashd rejects with bad-blk-sigops. A miner who produces such a block can split the network: Zebra nodes follow the offending chain while zcashd nodes do not. This issue has been patched in version 4.4.0.","severity":{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00283,"percentile":0.21048,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-682"],"published":"2026-05-07T20:54:33Z","modified":"2026-10-28T02:30:57Z","fixes":[{"ecosystem":"crates.io","package":"zebrad","fixed_in":["4.4.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"zebrad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"zebrad","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.4.0"}]}]}],"products":[{"vendor":"zcashfoundation","product":"zebra"},{"vendor":"zfnd","product":"zebrad"}],"references":[{"url":"https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-jv4h-j224-23cc","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://github.com/ZcashFoundation/zebra/releases/tag/v4.4.0","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44498","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jv4h-j224-23cc"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44498.json","tags":["advisory"]},{"url":"https://github.com/ZcashFoundation/zebra","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-44498","title":"ZEBRA: Block Validator Undercounts Coinbase and P2SH Sigops","description":"ZEBRA is a Zcash node written entirely in Rust. Prior to version 4.4.0, Zebra's block validator undercounts transparent signature operations against the 20000-sigop block limit (MAX_BLOCK_SIGOPS), allowing it to accept blocks that zcashd rejects with bad-blk-sigops. A miner who produces such a block can split the network: Zebra nodes follow the offending chain while zcashd nodes do not. This issue has been patched in version 4.4.0.","status":"published","published":"2026-05-08T15:09:09.919Z","modified":"2026-05-14T21:32:52.062Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N","level":"critical","assessor":"cna"}],"cwes":["CWE-682"],"updated_at":"2026-11-02T13:43:00.288193Z"}],"euvd":[{"id":"EUVD-2026-28783","description":"ZEBRA is a Zcash node written entirely in Rust. Prior to version 4.4.0, Zebra's block validator undercounts transparent signature operations against the 20000-sigop block limit (MAX_BLOCK_SIGOPS), allowing it to accept blocks that zcashd rejects with bad-blk-sigops. A miner who produces such a block can split the network: Zebra nodes follow the offending chain while zcashd nodes do not. This issue has been patched in version 4.4.0.","status":"published","published":"2026-05-08T15:09:09Z","modified":"2026-05-14T21:32:52Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N","level":"critical"}],"updated_at":"2026-11-02T19:04:30.595644Z"}],"ghsa":[{"id":"GHSA-jv4h-j224-23cc","title":"Zebra's Block Validator Undercounts Coinbase and P2SH Sigops","description":"Zebra's block validator undercounts transparent signature operations against the 20000-sigop block limit (`MAX_BLOCK_SIGOPS`), allowing it to accept blocks that `zcashd` rejects with `bad-blk-sigops`. A miner who produces such a block can split the network: Zebra nodes follow the offending chain while `zcashd` nodes do not.\n\nTwo distinct undercounts:\n\n#### A: Coinbase Hidden Legacy Sigops\n\n`zcashd`'s `GetLegacySigOpCount()` includes the coinbase input's `scriptSig`. Zebra's `Sigops` impl skipped the coinbase input entirely, so up to ~98 sigops (the 100-byte coinbase script length cap, less the height prefix) could be hidden inside the coinbase `scriptSig` without being charged against the block limit.\n\n#### B: Aggregate P2SH Sigops.\n\n`zcashd`'s `GetP2SHSigOpCount()` parses each P2SH input's redeem script with `accurate=true` and sums those sigops into the block-wide total via `ConnectBlock`. The check is per-block, not per-transaction, and the limit applies regardless of who mines the offending block — a miner just needs to include enough P2SH-spending transactions whose redeem scripts together exceed 20000 sigops. Zebra computed P2SH sigops only on the mempool-acceptance path (used for ZIP-317 weighting) and never accumulated them during block validation. A block whose aggregate redeem-script sigops exceed 20000 (e.g. 1334 P2SH spends × 15 sigops = 20010) would be accepted by Zebra and rejected by `zcashd`.\n\n### Patches\n\nFixed in this release:  https://github.com/ZcashFoundation/zebra/releases/tag/v4.4.0.\n\n### Workarounds\n\nNone. Operators relying on Zebra for consensus should upgrade.\n\n### Resources\n\n- `MAX_BLOCK_SIGOPS` constant inherited from Bitcoin via the Zcash protocol spec's §7.6 catch-all \"Other rules inherited from Bitcoin\", tracked for explicit documentation in [zcash/zips#568](https://github.com/zcash/zips/issues/568).\n- `zcashd` `GetLegacySigOpCount`: \u003chttps://github.com/zcash/zcash/blob/v6.11.0/src/main.cpp#L826-L836\u003e\n- `zcashd` `GetP2SHSigOpCount`: \u003chttps://github.com/zcash/zcash/blob/v6.11.0/src/main.cpp#L840-L852\u003e\n- `zcashd` `ConnectBlock` aggregates per-tx sigops and compares against `MAX_BLOCK_SIGOPS`.","status":"published","published":"2026-05-07T20:54:33Z","modified":"2026-05-13T13:28:48Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N","level":"critical"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-682"],"updated_at":"2026-11-02T14:40:07.01746Z"}],"nvd":[{"id":"CVE-2026-44498","description":"ZEBRA is a Zcash node written entirely in Rust. Prior to version 4.4.0, Zebra's block validator undercounts transparent signature operations against the 20000-sigop block limit (MAX_BLOCK_SIGOPS), allowing it to accept blocks that zcashd rejects with bad-blk-sigops. A miner who produces such a block can split the network: Zebra nodes follow the offending chain while zcashd nodes do not. This issue has been patched in version 4.4.0.","status":"published","published":"2026-05-08T15:17:01.637Z","modified":"2026-06-17T10:50:43.737Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-682"],"updated_at":"2026-11-02T14:12:17.842772Z"}],"osv":[{"id":"CVE-2026-44498","title":"ZEBRA: Block Validator Undercounts Coinbase and P2SH Sigops","description":"ZEBRA is a Zcash node written entirely in Rust. Prior to version 4.4.0, Zebra's block validator undercounts transparent signature operations against the 20000-sigop block limit (MAX_BLOCK_SIGOPS), allowing it to accept blocks that zcashd rejects with bad-blk-sigops. A miner who produces such a block can split the network: Zebra nodes follow the offending chain while zcashd nodes do not. This issue has been patched in version 4.4.0.","status":"published","published":"2026-05-08T15:09:09.919Z","modified":"2026-10-28T02:30:57.88373454Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N","level":"critical"}],"cwes":["CWE-682"],"updated_at":"2026-11-02T15:45:04.820169Z"},{"id":"GHSA-jv4h-j224-23cc","title":"Zebra's Block Validator Undercounts Coinbase and P2SH Sigops","description":"Zebra's block validator undercounts transparent signature operations against the 20000-sigop block limit (`MAX_BLOCK_SIGOPS`), allowing it to accept blocks that `zcashd` rejects with `bad-blk-sigops`. A miner who produces such a block can split the network: Zebra nodes follow the offending chain while `zcashd` nodes do not.\n\nTwo distinct undercounts:\n\n#### A: Coinbase Hidden Legacy Sigops\n\n`zcashd`'s `GetLegacySigOpCount()` includes the coinbase input's `scriptSig`. Zebra's `Sigops` impl skipped the coinbase input entirely, so up to ~98 sigops (the 100-byte coinbase script length cap, less the height prefix) could be hidden inside the coinbase `scriptSig` without being charged against the block limit.\n\n#### B: Aggregate P2SH Sigops.\n\n`zcashd`'s `GetP2SHSigOpCount()` parses each P2SH input's redeem script with `accurate=true` and sums those sigops into the block-wide total via `ConnectBlock`. The check is per-block, not per-transaction, and the limit applies regardless of who mines the offending block — a miner just needs to include enough P2SH-spending transactions whose redeem scripts together exceed 20000 sigops. Zebra computed P2SH sigops only on the mempool-acceptance path (used for ZIP-317 weighting) and never accumulated them during block validation. A block whose aggregate redeem-script sigops exceed 20000 (e.g. 1334 P2SH spends × 15 sigops = 20010) would be accepted by Zebra and rejected by `zcashd`.\n\n### Patches\n\nFixed in this release:  https://github.com/ZcashFoundation/zebra/releases/tag/v4.4.0.\n\n### Workarounds\n\nNone. Operators relying on Zebra for consensus should upgrade.\n\n### Resources\n\n- `MAX_BLOCK_SIGOPS` constant inherited from Bitcoin via the Zcash protocol spec's §7.6 catch-all \"Other rules inherited from Bitcoin\", tracked for explicit documentation in [zcash/zips#568](https://github.com/zcash/zips/issues/568).\n- `zcashd` `GetLegacySigOpCount`: \u003chttps://github.com/zcash/zcash/blob/v6.11.0/src/main.cpp#L826-L836\u003e\n- `zcashd` `GetP2SHSigOpCount`: \u003chttps://github.com/zcash/zcash/blob/v6.11.0/src/main.cpp#L840-L852\u003e\n- `zcashd` `ConnectBlock` aggregates per-tx sigops and compares against `MAX_BLOCK_SIGOPS`.","status":"published","published":"2026-05-07T20:54:33Z","modified":"2026-05-13T13:56:05.658252Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"},{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N","level":"critical"}],"cwes":["CWE-682"],"updated_at":"2026-11-02T15:46:51.10002Z"}]}}