9.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44498

CVE-2026-44498: ZEBRA: Block Validator Undercounts Coinbase and P2SH Sigops

ZEBRA is a Zcash node written entirely in Rust. Prior to version 4.4.0, Zebra's block validator undercounts transparent signature operations against the 20000-sigop block limit (MAX_BLOCK_SIGOPS), allowing it to accept blocks that zcashd rejects with bad-blk-sigops. A miner who produces such a block can split the network: Zebra nodes follow the offending chain while zcashd nodes do not. This issue has been patched in version 4.4.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44498

CVE-2026-44498:

9.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
zebrad	rust	< 4.4.0	4.4.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

An analysis of the provided security advisory and release information indicates that the vulnerability lies in Zebra's block validator, which undercounts transparent signature operations (sigops). This flaw could allow an attacker to create a block that is accepted by Zebra nodes but rejected by zcashd nodes, leading to a network split. The vulnerability has two components: the undercounting of legacy sigops in coinbase transactions and the failure to aggregate P2SH sigops during block validation.

The patches for this vulnerability were included in the Zebra v4.4.0 release. By comparing the git tags for versions v4.3.1 and v4.4.0, I was able to identify the commits included in the patch. The key changes are in the zebra-script crate, where the sigops counting logic was corrected.

Specifically, the Count implementation for Sigops was modified to correctly include coinbase inputs when counting legacy sigops. Additionally, a new method, p2sh_sigop_count, was added to the Transaction trait to properly calculate the sigops for P2SH scripts, which are now aggregated at the block level.

The vulnerable functions are those that were responsible for counting sigops before the patch. The primary function is zebra_script::Sigops::count, which previously ignored coinbase inputs. The exploitation of this vulnerability would involve this function, as well as the block validation process that relies on its output. The new p2sh_sigop_count function and the modifications to the Transaction trait are part of the mitigation and highlight the areas where the previous logic was deficient.

Vulnerable functions

zebra_script::Sigops::count

zebra-script/src/lib.rs

This function is responsible for counting the number of signature operations (sigops) in a transaction. Before the patch, it incorrectly skipped the coinbase input, leading to a potential undercount of sigops. An attacker could exploit this by crafting a block with a high number of sigops in the coinbase transaction, which would be accepted by vulnerable Zebra nodes but rejected by `zcashd` nodes, causing a network split.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.