CVE-2026-52735

{
  "id": "CVE-2026-52735",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-18T20:17:17.227",
  "lastModified": "2026-10-22T22:10:00.250",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, Zebra can accept a block that zcashd rejects because the P2SH signature-operation counter undercounts redeem scripts containing a disabled opcode followed by signature opcodes. In zebra-script/src/lib.rs, p2sh_input_sigop_count used the pure-Rust script::Code::sig_op_count path, whose try_fold parser stops at disabled opcodes such as OP_CODESEPARATOR and returns only the partial count accumulated before the error. The zcashd reference implementation continues static signature-operation counting through disabled opcodes, so an attacker can broadcast P2SH spends that Zebra counts below MAX_BLOCK_SIGOPS while zcashd counts above the 20,000-operation limit. If a Zebra miner includes those transactions, Zebra validators accept the block while zcashd validators reject it, creating a consensus chain split that affects network integrity and availability without requiring the attacker to produce a block. This issue is fixed in version 4.5.0."
    },
    {
      "lang": "es",
      "value": "ZEBRA es un nodo de Zcash escrito completamente en Rust. Antes de la versión 4.5.0, Zebra puede aceptar un bloque que zcashd rechaza porque el contador de operaciones de firma P2SH subestima los scripts de redención que contienen un opcode deshabilitado seguido de opcodes de firma. En zebra-script/src/lib.rs, p2sh_input_sigop_count usaba la ruta pure-Rust script::Code::sig_op_count, cuyo analizador try_fold se detiene en opcodes deshabilitados como OP_CODESEPARATOR y devuelve solo el recuento parcial acumulado antes del error. La implementación de referencia de zcashd continúa el conteo estático de operaciones de firma a través de opcodes deshabilitados, por lo que un atacante puede difundir gastos P2SH que Zebra cuenta por debajo de MAX_BLOCK_SIGOPS mientras que zcashd cuenta por encima del límite de 20.000 operaciones. Si un minero de Zebra incluye esas transacciones, los validadores de Zebra aceptan el bloque mientras que los validadores de zcashd lo rechazan, creando una división de la cadena de consenso que afecta la integridad y disponibilidad de la red sin requerir que el atacante produzca un bloque. Este problema está solucionado en la versión 4.5.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "ZcashFoundation",
          "product": "zebra",
          "versions": [
            {
              "version": "< 4.5.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 9.3,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "HIGH",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "HIGH",
          "subAvailabilityImpact": "HIGH",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-18T19:48:36.850142Z",
          "id": "CVE-2026-52735",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-684"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/ZcashFoundation/zebra/commit/1440b43ca7df59aca948090d45117557b217a6cd",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/ZcashFoundation/zebra/releases/tag/v4.5.0",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-gf9r-m956-97qx",
      "source": "[email protected]"
    }
  ]
}