CVE-2026-52735 ZEBRA: Consensus divergence via P2SH sigop undercount in pure-Rust disabled-opcode parser

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, Zebra can accept a block that zcashd rejects because the P2SH signature-operation counter undercounts redeem scripts containing a disabled opcode followed by signature opcodes. In zebra-script/src/lib.rs, p2shinputsigopcount used the...

CVE-2026-52735

Zebra (a Rust-based Zcash node) used a pure-Rust P2SH sigop counter that short-circuited on disabled opcodes like OP_CODESEPARATOR, undercounting sigops compared to zcashd. An attacker without mining power could trigger a chain split by broadcasting P2SH spends with malicious redeem scripts. Fixe...

CVE-2026-52735

creationtimestamp| type| source ---|---|--- 2026-07-03 21:50:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mprjo7adcd2x 2026-08-18 22:08:19+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtfa54nnq52p...