CVE-2026-104430

Executive Summary

CVE-2026-104430 is a consensus-divergence vulnerability in Zebra's Zcash node implementation (zebrad 4.5.0) and its script library (zebra-script 7.0.0), caused by incorrect counting of P2SH redeem-script signature operations. Rather than following zcashd's accurate P2SH sigop mode, Zebra operates in a legacy counting mode that overcounts CHECKMULTISIG operations when they are preceded by an OP_1 through OP_16 push, treating them as 20 sigops each. This discrepancy permits a remote, unauthenticated attacker to broadcast specially crafted P2SH spends using low-threshold multisig redeem scripts that push a valid block over Zebra's inflated MAX_BLOCK_SIGOPS threshold, causing Zebra nodes to reject blocks that zcashd accepts. The result is a network-level denial of service: Zebra nodes stall off the chain and stop tracking the consensus tip. With a CVSS score of 7.5 (High) and no patch available, operators of Zebra-based Zcash infrastructure are exposed to persistent chain-stall conditions without a vendor-supplied fix.

Technical Analysis

Zcash, like Bitcoin, enforces a per-block limit on the number of signature operations ("sigops") to bound the computational cost of block validation. In the original Bitcoin/Zcash consensus rules, the sigop cost of a CHECKMULTISIG operation is significant — approaching 20 sigops in legacy accounting — because a multisig check can require multiple ECDSA verifications. To keep accounting accurate, zcashd (the reference C++ implementation) uses a dedicated "accurate P2SH mode" that counts sigops in the redeem script of a P2SH spend according to the actual number of public keys involved, rather than applying a blanket legacy multiplier.

The NVD description states that zebrad 4.5.0 and zebra-script 7.0.0 implement sigop counting for P2SH redeem scripts "in legacy mode rather than zcashd's accurate P2SH mode." The specific overcounting behavior is:

• A CHECKMULTISIG operation that is immediately preceded by an OP_1 through OP_16 push (a small integer literal specifying the multisig threshold, e.g., a 1-of-2 or 2-of-3 script) is counted as 20 sigops by Zebra.
• zcashd, in accurate P2SH mode, counts the same operation by the actual number of keys/threshold, which for a low-threshold multisig is far fewer than 20.

This discrepancy is the root cause. Because Zebra overcounts, a block that is well within the true MAX_BLOCK_SIGOPS limit under zcashd's rules can exceed Zebra's inflated count. Zebra then classifies the block as invalid and rejects it, whereas zcashd accepts and extends the chain with it.

The vulnerability class is CWE-628: Function Call with Incorrectly Specified Arguments — more precisely, a consensus rule implementation divergence. It is a classic consensus-splitting bug: two implementations of the same protocol disagree on validity because of an arithmetic/accounting mismatch. No memory-safety issue, no authentication bypass, and no code-execution primitive is involved. The entire impact is an availability/consensus-integrity failure.

Thematically, this belongs to a well-known family of bugs in blockchain node reimplementations (the original Bitcoin Core OP_1-preceded CHECKMULTISIG sigop miscount, BIP-16 P2SH activation edge cases, and later SigOpCount consensus refinements). The affected attack surface is the block-acceptance / consensus-validation path: any peer that can deliver a block (i.e., any peer on the P2P network) can trigger it.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available for CVE-2026-104430. The attack chain below is inferred from the vulnerability class and the NVD description and is stated at the vulnerability-class level; no specific function names, file paths, or API parameters beyond those in the NVD description are asserted.

1. Reconnaissance / target identification. An attacker enumerates reachable Zcash P2P nodes and identifies Zebra-based peers (as opposed to zcashd-based peers). This can be done by fingerprinting peer behavior, version/user-agent strings, or by observing which blocks a peer propagates or rejects. The attacker does not need credentials, a privileged position, or local access — participation in the P2P network is sufficient, consistent with CVSS AV:N/AC:L/PR:N/UI:N.

2. Constructing the divergent block. The attacker builds (or has mined) a block containing a P2SH spend whose redeem script uses a low-threshold multisig — a CHECKMULTISIG immediately preceded by a small push (OP_1 through OP_16). Under zcashd's accurate P2SH sigop mode, the block's true sigop count stays within MAX_BLOCK_SIGOPS; under Zebra's legacy overcounting (20 sigops per such operation), the block's counted total exceeds the limit.

3. Broadcast / execution. The attacker broadcasts the block to the P2P network. zcashd nodes validate it and accept it as part of the chain (and may relay it). Zebra nodes, applying the inflated sigop count, evaluate the block as exceeding the consensus sigop limit and reject it.

4. Post-exploitation impact. Because Zebra and zcashd now disagree on the validity of the same block, Zebra nodes that reject a block accepted by the rest of the network stall — they do not extend the chain, fall behind the consensus tip, and remain off the accepted chain until the divergent condition is resolved or they sync from a chain that no longer contains the offending block. If the attacker can repeatedly publish such blocks (e.g., by controlling mining/relay or by exploiting favorable conditions), the stall can be sustained, degrading or halting Zebra-based infrastructure. Because this is a remote, unauthenticated, low-complexity action with high availability impact, the CVSS 7.5 rating is consistent. Note that exploitation requires the attacker to be able to get such a block into the network's accepted history — the precise feasibility depends on network mining/relay conditions not specified in the CVE data.

Impact Assessment

The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yields a base score of 7.5 (High). Breaking this down:

• Confidentiality: None (C:N). The flaw does not expose data.
• Integrity: None (I:N) as scored. No data is modified by the attacker; the divergence is a validity disagreement, not a corruption. (Note: in a broader view, consensus divergence is a form of state-integrity problem, but the CVSS scoring treats the direct channel as availability-only.)
• Availability: High (A:H). Affected Zebra nodes reject valid blocks and stall off the chain, ceasing to serve an up-to-date view of the Zcash ledger.
• Scope: Unchanged (S:U). The impact is confined to the vulnerable component.
• Attack Vector: Network (AV:N), Complexity: Low (AC:L), Privileges: None (PR:N), User Interaction: None (UI:N). Any network peer can attempt the attack without authentication or victim interaction.

Affected systems: Any Zcash node running zebrad 4.5.0 or embedding zebra-script 7.0.0 for block/script validation. This includes exchanges, custodial wallets, payment processors, mining pools, and monitoring/analytics infrastructure that rely on Zebra for chain state. zcashd-based nodes are not affected.

Blast radius: A stalled Zebra node cannot report confirmations, cannot serve accurate balances or block heights to downstream services, and cannot relay valid state. In a mixed zcashd/Zebra network, the split degrades consensus visibility and can trigger operational incident response, failover, and costly resynchronization. Where Zebra backs deposits/withdrawals or payment confirmations, chain stalls can delay settlement or cause incorrect business decisions based on stale state.

Detection Guidance

The following rules are detection scaffolding. Because the CVE provides no log format, transaction fields, or endpoint specifics, the rules target the class-level behavior (P2SH redeem-script sigop edge cases, consensus/sigop rejection events, and anomalous block-rejection activity) and must be tuned to the operator's actual Zebra log schema.

Sigma Rule

title: Zcash Zebra Consensus Sigops Overcounting / Block Rejection
id: 7b2f9c1a-1044-30ab-9f2e-000000104430
status: experimental
description: Detects Zebra node logs indicating block rejection tied to sigop count / consensus divergence (CVE-2026-104430)
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-104430
author: valtersit.com
logsource:
  product: zebra
  service: zebrad
detection:
  selection_sigops:
    message|contains:
      - 'exceeded MAX_BLOCK_SIGOPS'
      - 'sigop'
      - 'invalid block'
  selection_consensus:
    message|contains:
      - 'consensus'
      - 'rejected block'
  filter_normal:
    message|contains:
      - 'connection'
      - 'heartbeat'
  condition: (selection_sigops or selection_consensus) and not filter_normal
falsepositives:
  - Legitimate rejection of actually-invalid blocks
  - Verbose logging during initial block download
level: high

YARA Rule

rule CVE_2026_104430_Zebra_Sigop_Miscount
{
    meta:
        description = "Detection aid for Zebra P2SH sigop overcounting consensus divergence (CVE-2026-104430)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-104430"
        date = "2026"
    strings:
        $a = "MAX_BLOCK_SIGOPS"
        $b = "CHECKMULTISIG"
        $c = "sigop"
        $d = "zebra-script"
        $e = "zebrad"
        $f = "P2SH"
    condition:
        (uint32(0) == 0x464c457f or true) and
        filesize < 100MB and
        (2 of them)
}

Suricata IDS Rule

alert tcp any any -> any 8233 (msg:"CVE-2026-104430 Possible Zcash Zebra consensus divergence - oversized sigop block observed"; flow:to_server,established; content:"version"; depth:4; app-layer-protocol:zcash; metadata:affected_product Zebra_zebrad, cve CVE_2026_104430; classtype:attempted-dos; sid:10443001; rev:1;)

Note: Zcash's P2P message structure is not specified in the CVE data; the app-layer-protocol and ports should be adjusted to the operator's actual deployment. Port 8233 is the commonly referenced Zcash mainnet P2P port.

Elastic Detection

sequence by process.entity_id with maxspan=2m
  [ process where process.name : "zebrad" and message : "*sigop*" ]
  [ process where process.name : "zebrad" and
      (message : "*MAX_BLOCK_SIGOPS*" or message : "*rejected*" or message : "*invalid block*") ]

Splunk SPL Query

index=* (source="*zebrad*" OR sourcetype="zebrad")
| search (sigop OR "MAX_BLOCK_SIGOPS" OR "CHECKMULTISIG" OR "P2SH")
| search NOT ("connection" OR "heartbeat")
| stats count, values(message) as messages by host, source
| where count > 0
| sort - count

Deployment note: replace index=* with the operator's Zebra log index/sourcetype.

Wazuh OSSEC Rule

<group name="zebra,zcash,consensus,">
  <rule id="104430" level="12">
    <decoded_as>json</decoded_as>
    <field name="program">zebrad</field>
    <match>sigop|MAX_BLOCK_SIGOPS|invalid block|CHECKMULTISIG|P2SH</match>
    <description>CVE-2026-104430: Zebra node reported a possible consensus/sigop block rejection (chain-stall condition)</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>dos,consensus,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED). No patch evidence exists from any tracked source; the vendor fix is N/A and there are no listed affected-version ranges or OSV packages. Treat this as an open, unpatched consensus bug.

1) Immediate mitigations (while unpatched):

• Where operational tolerance permits, prefer zcashd-based nodes for consensus-critical functions (confirmations, deposits/withdrawals, chain-state queries) until a Zebra fix ships, since zcashd implements the accurate P2SH sigop mode and is not affected by the overcounting behavior.
• Isolate or deprioritize Zebra nodes in operational pipelines that depend on tracking the chain tip; monitor them closely so a stall can be detected and failed over quickly.
• Restrict P2P exposure where feasible: limit inbound peers, monitor for blocks that your node rejects while peers accept, and watch for repeated rejection events consistent with an adversarial broadcast.
• Maintain out-of-band alerting on MAX_BLOCK_SIGOPS/sigop rejection events and on increases in chain-tip lag, so a divergence-induced stall is caught before it cascades into settlement failures.

2) Patch / upgrade steps:

• No vendor patch is currently available for zebrad 4.5.0 or zebra-script 7.0.0. Track the Zcash/Zebra project's security advisories and release notes for a version that corrects the P2SH sigop counting to match zcashd's accurate P2SH mode.
• When a patched release is published, stage the upgrade on non-production nodes first, verify consensus behavior against the accepted chain, and roll out across the fleet with a rollback plan. Validate that the new version counts CHECKMULTISIG operations preceded by OP_1–OP_16 identically to zcashd before decommissioning zcashd fallbacks.

3) Long-term hardening:

• Add cross-implementation consensus tests (differential fuzzing between Zebra and zcashd on sigop accounting, especially P2SH redeem-script edge cases involving OP_1 through OP_16-preceded CHECKMULTISIG) into CI to catch future arithmetic divergences before release.
• Diversify node implementations in production so a single divergence cannot stall all your chain-tracking capacity, and architect failover so consensus stalls are survivable.
• Continuously monitor chain-tip lag and block-acceptance rate as operational health signals, alerting on divergence patterns rather than only on hard failures.

References

• NVD — CVE-2026-104430: https://nvd.nist.gov/vuln/detail/CVE-2026-104430
• MITRE CWE-628 — Function Call with Incorrectly Specified Arguments: https://cwe.mitre.org/data/definitions/628.html
• FIRST CVSS v3.1 Specification (base score 7.5, vector AS APPLIED): https://www.first.org/cvss/specification-document
• Zcash consensus / sigop and P2SH validation rules (script sigop accounting reference): Zcash protocol specification and zcashd source documentation
• Zebra (zebrad) project repository and security advisories: the Zcash Foundation / Zebra project maintainers

Exploit-in-the-wild / threat actor evidence: None. The CVE is not in CISA KEV, no public PoC or exploit code is known, and no threat-actor campaign has been associated with CVE-2026-104430 in the provided data. EPSS has not yet been scored by FIRST.org; no EPSS value should be assumed.