Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.1 and prior to zebra-script version 5.0.2, after a refactoring, Zebra failed to validate a consensus rule that restricted the possible values of sighash hash types for V5 transactions which were enabled in the NU5 network upgrade. Zebra nodes could thus accept and eventually mine a block that would be considered invalid by zcashd nodes, creating a consensus split between Zebra and zcashd nodes. In a similar vein, for V4 transactions, Zebra mistakenly used the "canonical" hash type when computing the sighash while zcashd (correctly per the spec) uses the raw value, which could also crate a consensus split. This issue has been patched in zebrad version 4.3.1 and zebra-script version 5.0.2.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-05-08 | 3 | Disclosure2Patch1 |
| 2026-05-12 | 5 | Disclosure4General1 |
| 2026-05-14 | 1 | Disclosure1 |
Summary ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.4.0 and prior to zebra-script version 6.0.0, the fix for CVE-2026-41583 introduced a separate issue due to insufficient error handling of the case where the sighash type is invalid, during…
Post summary
The snippet discusses CVE‑2026‑41583, noting that the applied fix created a separate issue involving invalid sighash error handling in ZEBRA.
References CVE: CVE-2026-41583 CVSS: 9.1 (3.1) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H Severity: CRITICAL Status: Critical advisory
Post summary
The advisory cites CVE-2026-41583 as a critical vulnerability with a CVSS score of 9.1, but does not provide proof‑of‑concept, exploit details, or remediation guidance.
--- Validated by the Lyrie Threat Intelligence Pipeline — 3 independent sources confirmed before publication. No speculation. CVE: CVE-2026-41583 CVSS: 9.1 (3.1) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H Severity: CRITICAL Status: Critical advisory
Post summary
The post announces the CVE‑2026‑41583 vulnerability with its severity rating, but provides no additional detail on exploitation, mitigation, or technical specifics.
https://lyrie.ai/research/research/cve-2026-41583-zfnd-zebra-script #lyrie #cybersecurity #CVE #threatintel #zerodayattack
Post summary
Only a link and hashtags are provided; the snippet contains no direct evidence of PoC, exploitation, mitigation, or technical details.
CRITICAL: CVE-2026-41583 (CVSS 9.1) — zfnd zebra-script. CVE: CVE-2026-41583 CVSS: 9.1 (3.1) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H Severity: CRITICAL Status: Critical advisory
Post summary
An advisory for CVE-2026-41583 specifying a critical CVSS score of 9.1 and indicating the severity status as critical.
CVE: CVE-2026-41583 CVSS: 9.1 (3.1) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H Severity: CRITICAL Status: Critical advisory ZEBRA is a Zcash node written entirely in Rust.
Post summary
The text announces a critical vulnerability (CVE‑2026‑41583) with a CVSS score of 9.1 and no further details on exploitation or mitigation.
🚨 CVE-2026-41583 — CVSS 9.1/10 █████████░ ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.1 and prior to zebra-script version 5.0.2,... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/OddCpU9K41
Post summary
CVE-2026-41583 is a critical vulnerability in Zebra, with patches available for zebrad 4.3.1 and zebra-script 5.0.2.
CVE-2026-44497 ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.4.0 and prior to zebra-script version 6.0.0, the fix for CVE-2026-41583 introduced a separat… https://www.cve.org/CVERecord?id=CVE-2026-44497
Post summary
The tweet announces CVE‑2026‑44497, a vulnerability affecting older ZEBRA versions, pointing out that upgrading to zebrad 4.4.0 or zebra‑script 6.0.0 mitigates the issue.
CVE-2026-41583 ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.1 and prior to zebra-script version 5.0.2, after a refactoring, Zebra failed to validate a… https://www.cve.org/CVERecord?id=CVE-2026-41583
Post summary
The statement announces a new CVE for the ZEBRA Zcash node, noting a validation failure before specific versions, but it does not offer technical details, exploitation evidence, or mitigation information.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | zfnd | zebra-script | - | rust | - |
| App | zfnd | zebrad | - | rust | - |