CVE-2026-40880 Zebra: Cached Mempool Verification Bypasses Consensus Rules for Ahead-of-Tip Blocks
A malicious miner can cause a consensus split in Zebra nodes by exploiting a verification cache logic error, leading to network partitioning.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-40880?
CVE-2026-40880 is a high-severity vulnerability in ZcashFoundation zebra-consensus, published on 21 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.1 and zebra-consensus version 5.0.2, a logic error in Zebra's transaction verification cache could allow a malicious miner to induce a consensus split. By carefully submitting a transaction that is valid for height H+1 but invalid for H+2 and then mining that transaction in a block at height H+2, a miner could cause vulnerable Zebra nodes to accept an invalid block, leading to a consensus split from the rest of the Zcash network. This vulnerability is fixed in zebrad version 4.3.1 and zebra-consensus version 5.0.2.
Weakness: CWE-1025
Which versions are affected by CVE-2026-40880?
4 open source packages ship an affected version, including zebra-consensus and zebrad. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
zebra-consensus crates.io | All versions | 5.0.2 |
zebra-consensus crates.io | All versions | 5.0.2 |
zebrad crates.io | All versions | 4.3.1 |
zebrad crates.io | All versions | 4.3.1 |
Products include Zfnd Zebra-Consensus, Zfnd Zebrad.
How do I fix CVE-2026-40880?
Upgrade zebra-consensus to 5.0.2 or later.
Is CVE-2026-40880 being exploited?
There is no known exploitation of CVE-2026-40880 in the wild and no public exploit code.
Sources
Also known as GHSA-xvj8-ph7x-65gf.