CVE-2026-44497

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.4.0 and prior to zebra-script version 6.0.0, the fix for CVE-2026-41583 introduced a separate issue due to insufficient error handling of the case where the sighash type is invalid, during sighash computation. Instead of returning an error, the normal flow would resume, and the input sighash buffer would be left untouched. In scenarios where a previous signature validation could leave a valid sighash in the buffer, an invalid hash-type could be incorrectly accepted, which would create a consensus split between Zebra and zcashd nodes. This issue has been patched in zebrad version 4.4.0 and zebra-script version 6.0.0.

• CWE-347

• https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-gq4h-3grw-2rhvVendor Advisory

Published

May 8, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4449Use after free in Blink in Google Chrome prior to 146.0.7680…8.8
• CVE-2026-44490Axios is a promise based HTTP client for the browser and Nod…8.2
• CVE-2026-44492Axios is a promise based HTTP client for the browser and Nod…8.6
• CVE-2026-44494Axios is a promise based HTTP client for the browser and Nod…8.7
• CVE-2026-44495Axios is a promise based HTTP client for the browser and Nod…7
• CVE-2026-44496Axios is a promise based HTTP client for the browser and Nod…7.5
• CVE-2026-44498ZEBRA is a Zcash node written entirely in Rust. Prior to ver…7.5
• CVE-2026-44499ZEBRA is a Zcash node written entirely in Rust. Prior to ver…8.7
• CVE-2026-4450Out of bounds write in V8 in Google Chrome prior to 146.0.76…8.8
• CVE-2026-44500ZEBRA is a Zcash node written entirely in Rust. Prior to zeb…5.3
• CVE-2026-44501DataHub is an open-source metadata platform. Prior to 1.5.0.…7.1
• CVE-2026-44502Bugsink is a self-hosted error tracking tool. Prior to 2.1.3…4.3