Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-104430— Zebra 4.5.0 Consensus Split via P2SH Sigop Overcount

Quick assessment

Affected
ZcashFoundation zebra
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Zebra zebrad 4.5.0 与 zebra-script 7.0.0 在采用遗留模式（legacy mode）下计算 P2SH 赎回脚本的签名操作数量，而非使用与 zcashd 一致的标准 P2SH 模式。该实现将前面带有 OP_1 至 OP_16 的 CHECKMULTISIG 操作错误地计为 20 个签名操作，从而导致共识分歧。远程攻击者可通过广播使用低阈值多重签名（multisig）赎回脚本的 P2SH 支出交易，构造一个在 zcashd 中有效、但因签名操作数量被 Zebra 高估而超过其 MAX

CVSS 7.5 · High EPSS 0.41% · P33

Affected Version Matrix 4

VendorProduct Version RangeStatus
ZcashFoundation zebra 4.5.0< 4.5.1 affected
4.5.1 unaffected
7.0.0< 7.0.1 affected
7.0.1 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-104430

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Zebra 4.5.0 Consensus Split via P2SH Sigop Overcount
Source: CVE Program / CVE List V5
Vulnerability Description
Zebra zebrad 4.5.0 and zebra-script 7.0.0 count P2SH redeem script signature operations in legacy mode rather than zcashd's accurate P2SH mode, overcounting CHECKMULTISIG preceded by OP_1 through OP_16 as 20 sigops and causing a consensus divergence. Remote attackers can broadcast P2SH spends using low-threshold multisig redeem scripts so that a block zcashd accepts exceeds Zebra's inflated MAX_BLOCK_SIGOPS count, causing Zebra nodes to reject it and stall off the chain.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
使用不正确指定参数的函数调用
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
ZcashFoundation zebra 4.5.0 ~ 4.5.1 -
ZcashFoundation zebra 7.0.0 ~ 7.0.1 -

II. Public POCs for CVE-2026-104430

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-104430

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-104430 (2)

Same Patch Batch · ZcashFoundation · 2026-10-02 · 18 CVEs total

CVE-2026-104423 7.5 HIGH Zebra before 6.2.1 Denial of Service via Uncapped V6 Shielded Proof Verification
CVE-2026-104431 7.5 HIGH Zebra before 6.0.0 Denial of Service via Synchronous Script FFI Verification
CVE-2026-104422 7.5 HIGH Zebra before 6.3.0 Block Sync Denial of Service via Coinbase scriptSig Rewrite
CVE-2026-104435 7.4 HIGH Zebra 4.4.0 Consensus Divergence via V5 SIGHASH_SINGLE Without Output
CVE-2026-104437 7.4 HIGH Zebra before 4.4.0 Consensus Split via SIGHASH_SINGLE Missing-Output Handling
CVE-2026-104434 6.5 MEDIUM Zebra before 8.0.0 Denial of Service via z_listunifiedreceivers RPC
CVE-2026-104426 5.9 MEDIUM Zebra before 6.1.0 Quadratic Complexity DoS via Block Transparent Value Check
CVE-2026-104427 5.9 MEDIUM Zebra before 6.1.0 Chain Stall via Stale parent_error_map Entry
CVE-2026-104428 5.3 MEDIUM Zebra before 11.0.0 Denial of Service via getblock Verbosity 2
CVE-2026-104432 5.3 MEDIUM Zebra before 6.3.0 False Readiness via Discarded One-Hash FindBlocks Response
CVE-2026-104425 5.3 MEDIUM Zebra before 6.1.0 Batch-Verification Poisoning DoS via Unattributed Pushed Transactions
CVE-2026-104420 5.3 MEDIUM Zebra before 6.3.0 Peer Misbehavior Ban Bypass via Gossiped Blocks
CVE-2026-104429 5.3 MEDIUM Zebra before 6.0.0-rc.0 Per-Peer Mempool Admission Bypass via P2P tx Messages
CVE-2026-104421 5.3 MEDIUM Zebra before 6.2.1 Block Download Denial of Service via KnownBlock SentHashes Lockout
CVE-2026-104419 4.8 MEDIUM Zebra before 6.3.0 Honest Peer Banning via Far-Ahead FindBlocks Hashes
CVE-2026-104424 3.7 LOW Zebra before 6.1.0 Incorrect Block Size Calculation in getblocktemplate
CVE-2026-104436 3.7 LOW Zebra before 4.5.0 CPU Amplification via Uncapped getblocks/getheaders Locator Length

IV. Related Vulnerabilities

Same product: zebra
Same vendor: ZcashFoundation
Same weakness: CWE-628

V. Comments for CVE-2026-104430

No comments yet

Leave a comment