Signature Operation Counting Flaw in Zebra by Zcash Foundation

CVE-2026-52735

What is CVE-2026-52735?

Zebra, a Zcash node implementation in Rust, is susceptible to a significant flaw where it can wrongly accept P2SH transactions that the official zcashd implementation would reject due to improper counting of signature operations. This occurs because Zebra's script parser stops counting at disabled opcodes, allowing attackers to create blocks that are numerically valid for Zebra but not for zcashd. This discrepancy results in network consensus splits, compromising the blockchain's integrity while enabling potential attack vectors for malicious actors. The issue was rectified in version 4.5.0, ensuring accurate validation across implementations.

References