Zebra (Zcash node) CVE-2026-41583

Exploitation requires the target Zcash network to include active Zebra nodes running versions prior to 4.3.1 that process transparent transactions. The attack works against default Zebra configurations with no special settings required - any Zebra node accepting V4 or V5 transactions is vulnerable. Network access is sufficient (CVSS AV:N), with no authentication (PR:N), user interaction (UI:N), or elevated privileges needed. The attacker must craft transactions with specifically malformed sighash hash type values: for V5 transactions, using hash type values outside the consensus-restricted set; for V4 transactions, exploiting the canonical vs. raw hash type computation mismatch. Exploitation is LIMITED by the current Zcash network topology: most mining nodes run zcashd rather than Zebra, reducing the probability that an invalid block will be mined and propagated. However, any Zebra node in the network can be exploited for denial-of-service by accepting invalid transactions, and network partition occurs whenever Zebra and zcashd nodes disagree on block validity regardless of miner distribution.

Real-world risk is critically high due to network-level consensus implications despite no current active exploitation. CVSS 4.0 score of 9.3 reflects maximum exploitability (AV:N/AC:L/PR:N/UI:N) with high integrity and availability impact across both vulnerable and subsequent systems (VI:H/VA:H/SI:H/SA:H). The attack requires no special access or complexity - any network participant can submit malformed transactions to trigger consensus divergence. However, actual impact is currently LIMITED by deployment realities: most Zcash miners run zcashd rather than Zebra, reducing immediate chain-split risk. The vulnerability enables three attack scenarios with different severities: (1) Network partitioning between Zebra and zcashd nodes, fragmenting consensus; (2) Denial of service against Zebra nodes accepting invalid blocks; (3) Potential double-spend attacks if attackers control sufficient Zebra mining power to sustain a minority chain. MISSING DATA: EPSS score not available; no CISA KEV listing; exploitation probability depends on attacker knowledge of Zebra node distribution. CRITICAL ASSESSMENT FACTOR: This is a consensus-layer vulnerability in cryptocurrency infrastructure where even brief exploitation creates irreversible blockchain divergence. Priority for patching is URGENT for any Zebra deployment, especially mining nodes, despite absence of public exploits. The 'Canonical' tag in source intelligence suggests the vulnerability relates to canonicalization issues between implementations.

An attacker crafts a Zcash V5 transaction with a transparent input signature using an invalid sighash hash type value outside the consensus-allowed range. They broadcast this transaction to the Zcash network. Zebra nodes (pre-4.3.1) accept the transaction as valid due to missing validation logic, while zcashd nodes correctly reject it per consensus rules. If a Zebra mining node includes this transaction in a mined block, that block is accepted by other Zebra nodes but rejected by zcashd nodes, creating an immediate network partition. The attacker can then exploit this split to execute double-spend attacks by broadcasting conflicting transactions to each network partition.