CVE-2026-44498 CRITICAL

CVE-2026-44498: ZEBRA: Block Validator Undercounts Coinbase and P2SH Sigops

Vendor Zcashfoundation
Product zebra
Weakness CWE-682
Published May 8, 2026
Last update May 14, 2026
View on NVD All CVEs

CVSS base score

9.2/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N

What the vulnerability does

01Description

ZEBRA is a Zcash node written entirely in Rust. Prior to version 4.4.0, Zebra's block validator undercounts transparent signature operations against the 20000-sigop block limit (MAX_BLOCK_SIGOPS), allowing it to accept blocks that zcashd rejects with bad-blk-sigops. A miner who produces such a block can split the network: Zebra nodes follow the offending chain while zcashd nodes do not. This issue has been patched in version 4.4.0.

Key dates

02Disclosure timeline

May 8, 2026 CVE published
May 14, 2026 Record updated