Zebra <=v4.4.1: Critical Consensus Divergence Vulnerability Confirmed
Zebra's P2SH sigop counter in versions up to and including v4.4.1 has a vulnerability that causes consensus divergence between Zebra and zcashd nodes, potentially leading to a chain split.
What happened
The vulnerability, tracked as GHSA-gf9r-m956-97qx, GHSA-hhm7-qrv5-h4r6, and GHSA-443g-gwgp-49x4, arises from Zebra's pure-Rust code path for disabled opcodes, which short-circuits and results in a partial count of zero. This undercount can be exploited by an attacker to trigger a chain split.
Affected components include zebrad (cargo) versions up to and including v4.4.1. Users of these versions are advised to monitor for updates and apply the fix as soon as it becomes available.
For more detailed information, consult the primary sources: [GHSA-gf9r-m956-97qx](https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-gf9r-m956-97qx), [GHSA-hhm7-qrv5-h4r6](https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-hhm7-qrv5-h4r6), and [GHSA-443g-gwgp-49x4](https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-443g-gwgp-49x4).
How 0Day mitigates this
zebrad is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.