CVE-2026-40880
Zfnd Zebra-Consensus ≤ 5.0.2
Raw vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-40880 is a high-severity Comparison Using Wrong Factors (CWE-1025) vulnerability in Zfnd Zebra-Consensus. Its CVSS base score is 7.2 (High).
Operationally, ranked at the 18th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-40880 is a logic error in the transaction verification cache of Zebra, a Zcash node written entirely in Rust. The vulnerability affects zebrad versions prior to 4.3.1 and zebra-consensus versions prior to 5.0.2, enabling a consensus split under specific conditions. It has a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) and is associated with CWE-1025.
A malicious miner with low privileges can exploit this vulnerability over the network with low complexity and no user interaction. By submitting a transaction valid for block height H+1 but invalid for H+2, and then mining that transaction into a block at height H+2, the attacker causes vulnerable Zebra nodes to accept the invalid block. This leads to a consensus split, where affected nodes diverge from the rest of the Zcash network, compromising integrity and availability.
The vulnerability is fixed in zebrad version 4.3.1 and zebra-consensus version 5.0.2. Additional details on the issue and mitigation are available in the GitHub Security Advisory at https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-xvj8-ph7x-65gf.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-24266
Vulnerability Data
ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.1 and zebra-consensus version 5.0.2, a logic error in Zebra's transaction verification cache could allow a malicious miner to induce a consensus split. By carefully submitting a…
more
transaction that is valid for height H+1 but invalid for H+2 and then mining that transaction in a block at height H+2, a miner could cause vulnerable Zebra nodes to accept an invalid block, leading to a consensus split from the rest of the Zcash network. This vulnerability is fixed in zebrad version 4.3.1 and zebra-consensus version 5.0.2.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover incorrect comparison logic after implementation but does not stop the flaw from being written.
Requiring a documented development process and tools can embed standards that reduce introduction of erroneous comparison factors.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC activities such as code review and logic testing directly prevent incorrect comparison factors in code.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect incorrect comparison results during development and acceptance.
Secure development lifecycle includes requirements and reviews that can catch incorrect comparison logic.
Application security requirements can specify correct comparison criteria and validation rules.
Secure coding standards directly address proper comparison logic and factor selection.