CVE Feed

    Dashboard / CVE / CVE-2026-104430

    CVE-2026-104430

    Zebra zebrad 4.5.0 and zebra-script 7.0.0 count P2SH redeem script signature operations in legacy mode rather than zcashd's accurate P2SH mode, overcounting CHECKMULTISIG preceded by OP_1 through OP_16 as 20 sigops and causing a consensus divergence. Remote attackers can broadcast P2SH spends using low-threshold multisig redeem scripts so that a block zcashd accepts exceeds Zebra's inflated MAX_BLOCK_SIGOPS count, causing Zebra nodes to reject it and stall off the chain.

    Published:Oct 2, 2026
    Last Modified:Oct 2, 2026
    EPS:Oct 2, 2026
    EPSS Score:
    CVSS Score:7.5

    Affected Products

    Vendor
    Zcashfoundation
    Product
    Zebra
    Vendor
    Zfnd
    Product
    Zebra

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-109366 (CVSS 6.3) — Zebra before 6.4.0 contains an improper integrity validation vulnerability in the inbound gossip download path…
    CVE-2026-109365 (CVSS 6.3) — Zebra before 6.4.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated pee…
    CVE-2026-109364 (CVSS 6.9) — Zebra 2.3.0 before 6.4.0 contains a protection mechanism failure that allows unauthenticated peers to evade ba…
    CVE-2026-109363 (CVSS 8.7) — ZcashFoundation Zebra 6.4.0 before 6.4.2 parses version 6 transactions carrying a pre-NU6.3 consensus branch I…
    CVE-2026-104437 (CVSS 8.3) — Zebra before 4.4.0 contains a consensus divergence vulnerability in V5 transparent signature verification, com…
    CVE-2026-104436 (CVSS 6.3) — Zebra before 4.5.0 contains an uncontrolled resource consumption vulnerability that allows remote P2P peers to…
    CVE-2026-104435 (CVSS 8.3) — Zebra zebrad 4.4.0 and zebra-script 6.0.0 fail to enforce a ZIP-244 consensus rule, accepting V5 transparent i…
    CVE-2026-104434 (CVSS 7.1) — ZcashFoundation Zebra zebra-rpc before 8.0.0 and zebrad before 4.5.0 contain a reachable assertion in the z_li…
    CVE-2026-104432 (CVSS 6.9) — Zebra before 6.3.0 contains an improper exceptional condition check in ChainSync::obtain_tips that discards va…
    CVE-2026-104431 (CVSS 8.7) — Zebra before 6.0.0 contains a denial of service vulnerability that allows unauthenticated peers to stall Tokio…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High