Signal is active with 4 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.4.0 and prior to zebra-script version 6.0.0, the fix for CVE-2026-41583 introduced a separate issue due to insufficient error handling of the case where the sighash type is invalid, during sighash computation. Instead of returning an error, the normal flow would resume, and the input sighash buffer would be left untouched. In scenarios where a previous signature validation could leave a valid sighash in the buffer, an invalid hash-type could be incorrectly accepted, which would create a consensus split between Zebra and zcashd nodes. This issue has been patched in zebrad version 4.4.0 and zebra-script version 6.0.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-05-08 | 3 | Disclosure1General1Patch1 |
| 2026-05-14 | 3 | Disclosure1General2 |
| 2026-06-10 | 4 | Disclosure3General1 |
Sources (Zcash Advisory) The Stale Buffer Trap: CVE-2026-44497 Breaks Zebra Consensus—Network Partition & Double-Spend Risk Imminent
Post summary
A new CVE (CVE‑2026‑44497) has been announced, indicating that the Zcash Zebra consensus could be broken, leading to potential network partitions and double‑spend risks, but no further technical, exploit or mitigation details are provided.
The Stale Buffer Trap: CVE-2026-44497 Shatters Zebra Consensus—Network Partition & Double-Spend Risk. When Zebra processes transparent transactions, it calls into C++ code to verify transaction signatures using the SIGHASH digest.
Post summary
Short text referencing CVE‑2026‑44497 in Zebra’s transparent transaction processing, but lacks concrete evidence of exploitation, detailed technical description, or patch information.
What Happened On May 8, 2026, the Zcash Foundation disclosed CVE-2026-44497, a consensus-critical vulnerability in the Zebra full-node implementation affecting version 4.3.1. The flaw stems from improper buffer management in the Rust-to-C++ FFI layer that wraps Bitcoin…
Post summary
Zcash Foundation disclosed CVE‑2026‑44497, a consensus‑critical buffer‑management flaw in the Zebra full‑node implementation, providing technical details but no evidence of a PoC, exploit, or patch.
The Stale Buffer Trap: CVE-2026-44497 Breaks Zebra Consensus—Network Partition & Double-Spend Risk Imminent When Zebra processes transparent transactions, it calls into C++ code to verify transaction signatures using the SIGHASH digest.
Post summary
The text announces CVE-2026-44497 as a potential risk to Zebra’s consensus, but provides no proof of concept, exploit details, or mitigation information.
CVE: CVE-2026-44497 CVSS: 9.1 (3.1) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H Severity: CRITICAL Status: Critical advisory ZEBRA is a Zcash node written entirely in Rust.
Post summary
The entry announces a critical advisory for CVE-2026-44497 affecting the ZEBRA Zcash node, providing its CVSS rating and severity, but offers no further exploitation or remediation details.
CVSS 9.1 CRITICAL · CVE-2026-44497 · 9.1 → 4.4.0 CVE: CVE-2026-44497 CVSS: 9.1 (3.1) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H Severity: CRITICAL Status: Critical advisory
Post summary
The text lists only the CVSS score, severity, and CVE identifier, confirming a critical vulnerability but providing no indication of proof of concept, exploit code, active exploitation, patches, or debunking.
CVE-2026-44497 ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.4.0 and prior to zebra-script version 6.0.0, the fix for CVE-2026-41583 introduced a separat… https://www.cve.org/CVERecord?id=CVE-2026-44497
Post summary
The text merely references CVE‑2026‑44497 without providing any substantive details, exploit links, or mitigation information.
https://lyrie.ai/research/research/cve-2026-44497-zfnd-zebra-script #lyrie #cybersecurity #CVE #threatintel #zerodayattack
Post summary
The post simply links to a research page for CVE-2026-44497, providing no further details on proof of concept, exploit availability, active exploitation, patches, or technical specifics.
🚨 CVE-2026-44497 in Zebra may cause consensus failures, risking network integrity and opening the door to malicious activity. Upgrade to the patched version now. 🔎 https://vulert.com/vuln-db/CVE-2026-44497 #CVE #BlockchainSecurity #CyberSecurity #Vulert https://t.co/TRUDLdWTBd
Post summary
The tweet highlights the CVE-2026-44497 vulnerability in Zebra, noting consensus failures and advising users to upgrade to a patched version.
🔴 Zebra, Consensus Divergence, #CVE-2026-44497 (Critical) https://dailycve.com/zebra-consensus-divergence-cve-2026-44497-critical/
Post summary
The post announces a critical CVE (CVE‑2026‑44497) called Zebra, Consensus Divergence, but provides no additional technical detail, PoC, or evidence of exploitation.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | zfnd | zebra-script | - | rust | - |
| App | zfnd | zebrad | - | rust | - |