CVE-2026-41563: Zebra Consensus Divergence in Sighash Handling Causes Network Fork

Vulnerability Summary: Consensus Divergence in Transparent Sighash Hash-Type Handling Vulnerability Overview CVE ID: CVE-2026-41563 Severity: Critical (9.3 / 10) CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/NSI:HSI:A Description: During refactoring, Zebra failed to enforce consensus rules that restrict the possible values of sighash hash types for V5 transactions. A Zebra node will accept and mine a block that is considered invalid by zcashd nodes, leading to a network fork. For V4 transactions, Zebra incorrectly used the "canonical" hash type, whereas zcashd uses the original value, also resulting in consensus divergence. Impact: Potential network partitioning, service disruption, and possible double-spending attacks. Scope of Impact Affected Versions: - (Rust): <5.0.2 - (Rust): <4.3.1 Attack Vector: Network Attack Complexity: Low Impact Scope: Any affected Zebra node Remediation Fixed Version: Zebra 4.3.1 Fix Details: Added consensus checks in the callers of the C++ verification code and utilized the original hash type from the V4 sighash calculation. Mitigation: Users should immediately upgrade to Zebra 4.3.1 or later. There are currently no known workarounds; immediate upgrading is the only method to ensure nodes remain on the correct consensus path and are protected against malicious chain forks. Proof of Concept (POC) Specific POC code is not provided on the page, but the exploitation method is described as follows: Submit a V4 or V5 transaction with an invalid sighash hash type. The V5 transaction will be accepted by Zebra nodes but rejected by zcashd nodes (or vice versa), creating a consensus fork within the network.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-41563: Zebra Consensus Divergence in Sighash Handling Causes Network Fork

More from this source