CVE-2026-44498: Zebra's Block Validator Undercounts Coinbase and P2SH Sigops

May 7, 2026 (updated May 13, 2026)

Zebra’s block validator undercounts transparent signature operations against the 20000-sigop block limit (MAX_BLOCK_SIGOPS), allowing it to accept blocks that zcashd rejects with bad-blk-sigops. A miner who produces such a block can split the network: Zebra nodes follow the offending chain while zcashd nodes do not.

Two distinct undercounts:

References

github.com/ZcashFoundation/zebra/releases/tag/v4.4.0
github.com/ZcashFoundation/zebra/security/advisories/GHSA-jv4h-j224-23cc
github.com/advisories/GHSA-jv4h-j224-23cc
nvd.nist.gov/vuln/detail/CVE-2026-44498

Code Behaviors & Features

Detect and mitigate CVE-2026-44498 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →