External risk intelligence

Zebra Node Consensus Split Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-52735

Zebra is a Zcash node implementation, which by design must participate in a public peer-to-peer network and expose interfaces to receive and validate transactions and blocks from the internet to function correctly.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory highlights a critical vulnerability in the ZEBRA Zcash node implementation that could disrupt network integrity and availability. The issue arises from an incorrect counting of signature operations in specific transaction types, potentially allowing malicious actors to broadcast transactions that an affected ZEBRA node accepts, while the reference implementation would reject them, leading to a consensus split. The main concern is confirming relevance and exposure within your operational environment.

Incorrectly counts transaction operations.
Could split the Zcash network.
Assess your Zcash node's exposure.

Attack Path

How an attacker could exploit the issue

An attacker could broadcast specially crafted transactions to a Zcash network running a vulnerable Zebra node. These transactions are designed to appear valid to Zebra due to an undercounting of signature operations, while being rejected by the standard Zcash implementation. This discrepancy can lead to a consensus chain split, disrupting network integrity and availability without the attacker needing to mine a block.

No authentication required for entry.
Malicious transactions trigger incorrect counting.
Risk of network consensus split.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could impact the integrity and availability of the Zcash network by allowing a malicious actor to create a consensus chain split. This occurs when the Zcash node, Zebra, accepts a block that the reference implementation, zcashd, rejects due to an incorrect signature-operation count in P2SH spends. This discrepancy can lead to Zebra validators accepting a block that zcashd validators do not, disrupting the network's consensus.

Network consensus integrity.
Malicious transactions accepted by Zebra.
Disruption of network availability.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects the Zcash node implementation, Zebra, and could lead to a consensus chain split impacting network integrity. Responsibility for addressing this likely falls to the team managing the Zebra node infrastructure, potentially in coordination with the Zcash community or development team if it's a widely deployed component. The initial step should be to identify all running instances of Zebra, determine their network exposure and criticality, and then engage the accountable team to plan remediation, considering vendor coordination if necessary.

Own by: Zcash node infrastructure team.
Verify first: Network exposure and business criticality.
Action: Plan coordinated remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Zebra in the context of the Zcash network?

Zebra is a Zcash node implementation written in Rust. It functions as a peer in the Zcash network, responsible for receiving, validating, and relaying blocks and transactions. Users operate Zebra to maintain a local copy of the blockchain and support network operations, ensuring it stays synchronized with the broader Zcash ecosystem by following consensus rules that match the reference implementation, zcashd.

How does CVE-2026-52735 create a consensus split?

This vulnerability is an Improper Calculation of Machine Code Size, classified as CWE-684. It occurs because Zebra incorrectly counts signature operations in specific P2SH transactions. Because Zebra stops counting when it hits a disabled opcode while the standard zcashd does not, Zebra may accept a block that the reference software rejects. This disagreement between nodes creates a chain split, effectively breaking the shared rules that keep the network consistent and functional.

Can any transaction trigger this Zebra vulnerability?

No. The issue is specific to P2SH (Pay to Script Hash) transactions that contain a disabled opcode followed by signature-counting opcodes. Standard transactions that do not utilize this specific sequence of opcodes will not trigger the counting discrepancy. The vulnerability specifically exploits the difference in how Zebra and zcashd parsers handle these legacy or disabled commands during signature verification.

Is my Zebra node at risk if it is not internet-facing?

According to Halo Surface Signal, Zebra is designed to communicate over public peer-to-peer networks to function, making it inherently exposed to incoming traffic. Even if a node is not explicitly public-facing, it must process data from external peers to maintain consensus. If your node receives malicious transactions from its peer connections, it remains susceptible to the consensus split regardless of its specific network configuration.

How do I secure my infrastructure against this threat?

The primary resolution is to update your Zebra node software to version 4.5.0 or later, which corrects the signature-operation counting logic. Before applying the fix, locate all instances of Zebra within your environment to confirm which nodes are running affected versions. Coordinate with your infrastructure team to prioritize these updates, as they are essential to maintaining compatibility with the rest of the Zcash network and preventing potential chain splits.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.