CVE-2026-52735

Name of the Vulnerable Software and Affected Versions Zebra versions prior to 4.4.2

Description Zebra can accept blocks that the zcashd reference implementation rejects due to a discrepancy in how P2SH (Pay-to-Script-Hash) signature-operation counters handle disabled opcodes. In the zebra-script/src/lib.rs file, the p2sh input sigop count function uses a pure-Rust path that stops counting when it encounters a disabled opcode, such as OP CODESEPARATOR, returning only a partial count. In contrast, zcashd continues counting through disabled opcodes during static analysis.

An attacker can exploit this by broadcasting P2SH spends with redeem scripts containing a disabled opcode followed by signature opcodes. If a Zebra miner includes these transactions, Zebra validators will see the block as being under the MAX BLOCK SIGOPS limit of 20,000, while zcashd validators will see it as exceeding the limit and reject it. This results in a consensus chain split, affecting network integrity and availability. The attacker does not require mining capabilities to trigger this divergence.

Recommendations Update Zebra to version 4.4.2 or later.