CVE-2026-104430 Zebra 4.5.0 Consensus Split via P2SH Sigop Overcount
Remote attackers can cause Zebra nodes to stall off the chain by broadcasting blocks that trigger a consensus divergence due to incorrect signature operation counting.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-104430?
CVE-2026-104430 is a high-severity denial of service vulnerability in ZcashFoundation zebra, published on 2 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Zebra zebrad 4.5.0 and zebra-script 7.0.0 count P2SH redeem script signature operations in legacy mode rather than zcashd's accurate P2SH mode, overcounting CHECKMULTISIG preceded by OP_1 through OP_16 as 20 sigops and causing a consensus divergence. Remote attackers can broadcast P2SH spends using low-threshold multisig redeem scripts so that a block zcashd accepts exceeds Zebra's inflated MAX_BLOCK_SIGOPS count, causing Zebra nodes to reject it and stall off the chain.
Weakness: CWE-628
Which versions are affected by CVE-2026-104430?
How do I fix CVE-2026-104430?
No fix has been published for CVE-2026-104430 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-104430 being exploited?
There is no known exploitation of CVE-2026-104430 in the wild and no public exploit code.
Sources
Also known as GHSA-2prc-cj5x-4443, GHSA-4c53-mmm8-cf87.