CVE-2026-41583 is a critical consensus flaw (CVSS 9.1) in Zebra, the Rust Zcash node. Before zebrad 4.3.1 and zebra-script 5.0.2, Zebra skipped a rule on sighash hash types, so it could disagree with zcashd about which blocks are valid. Upgrade both.
What's affected
Per the GitHub advisory:
zebradbefore 4.3.1, fixed in 4.3.1.zebra-scriptbefore 5.0.2, fixed in 5.0.2.
The advisory says all Zebra versions before 4.3.1 are affected, apart from some older versions that are not impacted but are no longer supported by the network.
How to check if you're exposed
For a node you run:
zebrad --version
For Rust projects that depend on the crate:
cargo tree -i zebra-script
Confirm that the resolved versions meet the fixed numbers. If you run a Zcash node for a service, an exchange integration or a mining setup, find out whether it runs Zebra or zcashd, and which version.
What to do now
- Upgrade zebrad to 4.3.1 or later and zebra-script to 5.0.2 or later.
- Restart nodes after the upgrade and check that they are following the expected chain.
- If you operate infrastructure that depends on Zebra, watch for chain split alerts from your own monitoring and from the network community.
- For miners or pools running Zebra, confirm your block template software has the fix before you mine on it.
Why it matters
The record lists CWE-573, improper following of a specification by a caller. The advisory explains what happened. Transparent signature checking used C++ code through a foreign function interface, and a refactoring moved most of the work into Rust with a callback. One consensus rule, accepting only known hash types, had lived in the C++ code and was not carried over. For V4 transactions, Zebra also used a canonical hash type where zcashd uses the raw value.
The result is that nodes could accept and even mine a block that other nodes reject, which can partition the network. The advisory notes that the impact is currently reduced because most miners run zcashd. It describes potential double spend attacks against affected nodes. The record does not flag this CVE as known exploited.
Quick check
Does this affect people who only hold Zcash?
The advisory concerns node software. If you use a wallet or service, ask the operator whether they run Zebra and have upgraded.
Sources
Last reviewed: 19 October 2026.
