{"id":"CVE-2026-44498","aliases":["GHSA-jv4h-j224-23cc"],"url":"https://o3.security/vulnerability/CVE-2026-44498","summary":"ZEBRA: Block Validator Undercounts Coinbase and P2SH Sigops","details":"ZEBRA is a Zcash node written entirely in Rust. Prior to version 4.4.0, Zebra's block validator undercounts transparent signature operations against the 20000-sigop block limit (MAX_BLOCK_SIGOPS), allowing it to accept blocks that zcashd rejects with bad-blk-sigops. A miner who produces such a block can split the network: Zebra nodes follow the offending chain while zcashd nodes do not. This issue has been patched in version 4.4.0.","published":"2026-05-08T15:09:09.919Z","modified":"2026-08-07T11:51:08.191322537Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"zebrad","fixedVersion":"4.4.0"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/ZcashFoundation/zebra/releases/tag/v4.4.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44498.json"},{"type":"ADVISORY","url":"https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-jv4h-j224-23cc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44498"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-07T11:51:08.191322537Z"}}