Zebra (zebrad): Consensus split via P2SH sigop overcount
Summary
Zebra 4.5.0 (zebrad) and zebra-script 7.0.0 count signature operations in P2SH redeem scripts using the legacy mode, which overcounts CHECKMULTISIG preceded by OP_1 to OP_16 as 20 instead of the true key count. An attacker can broadcast P2SH spends with low-threshold multisig redeem scripts, so that a block accepted by zcashd exceeds Zebra's inflated MAX_BLOCK_SIGOPS limit. Zebra nodes then reject that block and every later block on the canonical chain, stalling off the chain. No mining capability or privileges are needed, and any miner, including an honest one, can include such transactions by accident.
Affected
- Zebra (zebrad) 4.5.0 to before 4.5.1
- zebra-script 7.0.0 to before 7.0.1
- Default configurations are affected.
Fixed in
- Zebra (zebrad) 4.5.1
- zebra-script 7.0.1
Workaround
No configuration-level workaround is documented. Upgrading is the only known remedy.
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- No evidence of exploitation in the wild and no public proof of concept was found in the research.
Our recommendation
- Upgrade Zebra to 4.5.1 or later, or zebra-script to 7.0.1 or later, as soon as possible.
- Check all running Zebra nodes for versions 4.5.0 or 7.0.0 of zebra-script.
- If a Zebra node has stalled or rejects blocks that zcashd accepts, compare its chain tip with a patched node or zcashd peer and resynchronise if needed.
- Monitor node logs for TooManyTransparentSignatureOperations errors.
- If you do not run Zebra or zebra-script, no action is needed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-2prc-cj5x-4443 github.com
- VulnCheck advisory: Zebra 4.5.0 Consensus Split via P2SH Sigop Overcount www.vulncheck.com
- OSV: CVE-2026-104430 osv.dev
- Zebra 4.5.1 security fixes (Zcash Foundation) zfnd.org
- Vulners: CVE-2026-104430 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:01.
Original description (NVD)
Zebra zebrad 4.5.0 and zebra-script 7.0.0 count P2SH redeem script signature operations in legacy mode rather than zcashd's accurate P2SH mode, overcounting CHECKMULTISIG preceded by OP_1 through OP_16 as 20 sigops and causing a consensus divergence. Remote attackers can broadcast P2SH spends using low-threshold multisig redeem scripts so that a block zcashd accepts exceeds Zebra's inflated MAX_BLOCK_SIGOPS count, causing Zebra nodes to reject it and stall off the chain.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.