CVE-2026-40880: Zebra: Cached Mempool Verification Bypasses Consensus Rules for Ahead-of-Tip Blocks

April 18, 2026 (updated April 27, 2026)

A logic error in Zebra’s transaction verification cache could allow a malicious miner to induce a consensus split. By carefully submitting a transaction that is valid for height H+1 but invalid for H+2 and then mining that transaction in a block at height H+2, a miner could cause vulnerable Zebra nodes to accept an invalid block, leading to a consensus split from the rest of the Zcash network.

References

github.com/ZcashFoundation/zebra/security/advisories/GHSA-xvj8-ph7x-65gf
github.com/advisories/GHSA-xvj8-ph7x-65gf
nvd.nist.gov/vuln/detail/CVE-2026-40880

Code Behaviors & Features

Detect and mitigate CVE-2026-40880 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →