CVE-2026-44497 is a critical signature verification flaw (CVSS 9.1) in Zebra, the Zcash node written in Rust. An invalid hash type could be accepted, which can split consensus with zcashd nodes. Upgrade zebrad to 4.4.0 and zebra-script to 6.0.0 on every node you operate.
What's affected
From the project advisory:
- zebra-script: affected 5.0.1, fixed in 6.0.0.
- zebrad: affected 4.3.1, fixed in 4.4.0.
The advisory describes this as an issue introduced by the fix for an earlier flaw, CVE-2026-41583. The earlier fix added a check for undefined hash types on the Rust side. The new bug is in how that failure is passed across the boundary to the C++ script code.
The advisory says the impact is lessened because most miners currently run zcashd, but it still rates the issue as critical because it is a consensus vulnerability.
How to check if you're exposed
Check your node version:
zebrad --version
If you build from source or depend on the library crates, check which version of zebra-script is in your tree:
cargo tree -i zebra-script
Anything on zebrad 4.3.1 or zebra-script 5.0.1 is in scope.
What to do now
- Upgrade zebrad to 4.4.0 and zebra-script to 6.0.0.
- If you run exchange, wallet or service infrastructure on Zebra, watch for chain divergence from other nodes after the upgrade, and compare tip hashes against a second implementation.
- If you vendor the crates, rebuild and redeploy, not only update the lock file.
- Follow the project security advisories page for later updates.
Why it matters
The class is CWE-347 (improper verification of cryptographic signature). Zebra checks transparent transactions by calling Bitcoin script verification code in C++, with a Rust callback that computes the signature hash. When the callback rejected an invalid type, the bridge did not write to the buffer, and the C++ code read the buffer anyway. The failure signal was lost, and whatever an earlier check had left in the buffer was reused.
In a blockchain, nodes must agree on exactly which transactions are valid. If two implementations disagree, the network can partition. The advisory says that could cause service disruption and potential double spend attacks against affected nodes.
The record does not mark this CVE as KEV. The root lesson is to treat error returns across language boundaries as part of the security contract, and to make failure the default outcome.
Quick check
Is zcashd affected?
The advisory describes the problem in Zebra and a split between Zebra and zcashd. It does not list zcashd as vulnerable.
Sources
Last reviewed: 19 October 2026.
