{"id":"CVE-2026-104430","summary":"Zebra 4.5.0 Consensus Split via P2SH Sigop Overcount","details":"Zebra zebrad 4.5.0 and zebra-script 7.0.0 count P2SH redeem script signature operations in legacy mode rather than zcashd's accurate P2SH mode, overcounting CHECKMULTISIG preceded by OP_1 through OP_16 as 20 sigops and causing a consensus divergence. Remote attackers can broadcast P2SH spends using low-threshold multisig redeem scripts so that a block zcashd accepts exceeds Zebra's inflated MAX_BLOCK_SIGOPS count, causing Zebra nodes to reject it and stall off the chain.","aliases":["GHSA-2prc-cj5x-4443"],"modified":"2026-10-04T02:46:34.825428368Z","published":"2026-10-02T11:38:09.916Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"introduced":"7.0.0"},{"fixed":"7.0.1"}],"source":"AFFECTED_FIELD"}],"cna_assigner":"VulnCheck","cwe_ids":["CWE-628"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104430.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104430.json"},{"type":"ADVISORY","url":"https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-2prc-cj5x-4443"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104430"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/zebra-4.5.0-consensus-split-via-p2sh-sigop-overcount"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/zcashfoundation/zebra","events":[{"introduced":"1440b43ca7df59aca948090d45117557b217a6cd"},{"fixed":"76c440e67f2c909cbf8418b11a3f56371aed7d95"}],"database_specific":{"extracted_events":[{"introduced":"4.5.0"},{"fixed":"4.5.1"},{"introduced":"OP_1"},{"fixed":"OP_16"}],"source":["AFFECTED_FIELD","DESCRIPTION"]}}],"versions":["v4.5.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104430.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}