Zebra-script vulnerabilities

2 known vulnerabilities in Zebra-script from Zfnd. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.1 Critical severity

  zebra: Improper Verification of Cryptographic Signature

  CVE-2026-44497May 8, 2026ZcashFoundation

  ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.4.0 and prior to zebra-script version 6.0.0, the fix for CVE-2026-41583 introduced a separate issue due to insufficient error handling of the case where the sighash type is invalid, duri

• 9.1 Critical severity

  zebra: Improper Following of Specification by Caller

  CVE-2026-41583May 8, 2026ZcashFoundation

  ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.1 and prior to zebra-script version 5.0.2, after a refactoring, Zebra failed to validate a consensus rule that restricted the possible values of sighash hash types for V5 transactions