CVE-2026-44498
Analyzed Analyzed - Analysis Complete
Zebra Block Validator SigOp Undercount Vulnerability

Publication date: 2026-05-08

Last updated on: 2026-05-08

Assigner: GitHub, Inc.

Description
ZEBRA is a Zcash node written entirely in Rust. Prior to version 4.4.0, Zebra's block validator undercounts transparent signature operations against the 20000-sigop block limit (MAX_BLOCK_SIGOPS), allowing it to accept blocks that zcashd rejects with bad-blk-sigops. A miner who produces such a block can split the network: Zebra nodes follow the offending chain while zcashd nodes do not. This issue has been patched in version 4.4.0.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-08
Last Modified
2026-05-08
Generated
2026-06-19
AI Q&A
2026-05-08
EPSS Evaluated
2026-06-18
NVD
CVE-2026-44498
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
zfnd zebrad to 4.4.0 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-682 The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Impact Analysis

The vulnerability can lead to a network split between Zebra nodes and zcashd nodes. This split can cause inconsistencies in the blockchain state across different nodes, potentially undermining the reliability and security of the network.

If you run a Zebra node, you might follow a chain that is considered invalid by the majority of the network (zcashd nodes), which can affect transaction finality and consensus.

Executive Summary

This vulnerability exists in Zebra, a Zcash node implementation written in Rust. Prior to version 4.4.0, Zebra's block validator undercounts transparent signature operations (sigops) against the 20000-sigop block limit (MAX_BLOCK_SIGOPS). This means Zebra accepts blocks that exceed the sigop limit, which are rejected by the official zcashd node with a bad-blk-sigops error.

As a result, a miner can produce a block that Zebra nodes accept but zcashd nodes reject, causing a network split where Zebra nodes follow a different chain than zcashd nodes. This issue was fixed in Zebra version 4.4.0.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Zebra to version 4.4.0 or later, where the issue with undercounting transparent signature operations has been patched.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-44498. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart