Zebra (Zcash node) CVE-2026-41583

Immediately upgrade to zebrad version 4.3.1 or later and zebra-script version 5.0.2 or later, available from the Rust package repository and GitHub releases at https://github.com/ZcashFoundation/zebra. The fix is implemented in commit 1f605eca5c55e3b65229fa01a97d9aa84fd37447, which adds consensus validation of sighash hash types in the Rust caller before invoking C++ verification code, and corrects V4 sighash computation to use raw hash type values per specification. Full technical details are available in the GitHub security advisory at https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-8m29-fpq5-89jj. If immediate patching is not feasible, SPECIFIC compensating controls include: (1) Temporarily disable acceptance of V4 and V5 transparent transactions via transaction policy rules if Zebra configuration supports this - this prevents exploitation but significantly reduces node functionality; (2) Deploy network-level monitoring to detect consensus divergence by comparing block acceptance between Zebra and zcashd nodes, enabling rapid detection of exploitation attempts; (3) For mining operations, switch to zcashd reference implementation until patching is complete, as most miners already run zcashd, reducing chain-split risk. Note these workarounds have severe trade-offs: disabling transaction types breaks core functionality, monitoring only detects attacks without preventing them, and switching implementations requires operational overhead. No workaround provides equivalent security to patching.