CVE-2026-44498

Published: Mag 08, 2026 Last Modified: Mag 08, 2026
ExploitDB:
Other exploit source:
Google Dorks:
CRITICAL 9,2
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
HIGH 7,5
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: high
Availability: none

Description

AI Translation Available

ZEBRA is a Zcash node written entirely in Rust. Prior to version 4.4.0, Zebra's block validator undercounts transparent signature operations against the 20000-sigop block limit (MAX_BLOCK_SIGOPS), allowing it to accept blocks that zcashd rejects with bad-blk-sigops. A miner who produces such a block can split the network: Zebra nodes follow the offending chain while zcashd nodes do not. This issue has been patched in version 4.4.0.

682

Incorrect Calculation

Draft
Abstraction: Pillar Structure: Simple
Common Consequences
Security Scopes Affected:
Availability Integrity Confidentiality Access Control
Potential Impacts:
Dos: Crash, Exit, Or Restart Dos: Resource Consumption (Other) Execute Unauthorized Code Or Commands Gain Privileges Or Assume Identity Bypass Protection Mechanism
Applicable Platforms
All platforms may be affected
Likelihood of Exploit: High
View CWE Details
Application

Zebrad by Zfnd

Product Information
Vendor Zfnd
Product Zebrad
Version Range Affected
To 4.4.0 (exclusive)
cpe:2.3:a:zfnd:zebrad:*:*:*:*:*:rust:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://github.com/ZcashFoundation/zebra/releases/tag/v4.4.0
https://github.com/ZcashFoundation/zebra/releases/tag/v4.4.0
https://github.com/ZcashFoundation/zebra/security/advisorie…
https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-jv4h-j224-23cc