{"id":"CVE-2026-104430","published":"2026-10-02T12:17:13.467","lastModified":"2026-10-02T17:59:09.430","description":"Zebra zebrad 4.5.0 and zebra-script 7.0.0 count P2SH redeem script signature operations in legacy mode rather than zcashd's accurate P2SH mode, overcounting CHECKMULTISIG preceded by OP_1 through OP_16 as 20 sigops and causing a consensus divergence. Remote attackers can broadcast P2SH spends using low-threshold multisig redeem scripts so that a block zcashd accepts exceeds Zebra's inflated MAX_BLOCK_SIGOPS count, causing Zebra nodes to reject it and stall off the chain.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-628"],"vendors":[],"products":[],"references":[{"url":"https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-2prc-cj5x-4443","tags":[]},{"url":"https://www.vulncheck.com/advisories/zebra-4.5.0-consensus-split-via-p2sh-sigop-overcount","tags":[]}],"exploitRefs":[{"url":"https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-2prc-cj5x-4443","tags":[]}],"hasPoc":true,"ai":{"summary":"Zebra nodes incorrectly count signature operations in P2SH redeem scripts, overcounting multisig signatures by 20 sigops each when they should use Zcash's accurate P2SH mode instead of legacy mode. This causes a consensus divergence where valid blocks accepted by zcashd are rejected by Zebra nodes, leading to chain stalls.","exploitability":"Exploitation is relatively straightforward for remote attackers who can broadcast specially crafted P2SH spends using low-threshold multisig redeem scripts that exceed Zebra's inflated MAX_BLOCK_SIGOPS count, requiring no authentication or special preconditions.","blast_radius":"The impact could be significant as it would cause Zebra nodes to reject valid blocks from zcashd, potentially leading to chain forks or complete network stall if enough nodes are running Zebra software.","remediation":"Upgrade to Zebra zebrad 4.5.1 or later and zebra-script 7.0.1 or later to fix the P2SH signature operation counting issue.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["consensus","p2sh","block-validation"],"model":"garnet-coder","analyzedAt":"2026-10-12T09:03:34.074Z"}}