# ZF Engineering Update: April 20th – May 3rd, 2026 **URL:** \ **Category:** Zcash Foundation\ **Created:** [May 6, 2026, 8:33pm UTC](https://forum.zcashcommunity.com/t/zf-engineering-update-april-20th-may-3rd-2026/55618 "2026-05-06T20:33:48Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![ZcashFoundation](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/zcashfoundation/32/21548_2.png) [@ZcashFoundation](https://forum.zcashcommunity.com/u/ZcashFoundation)\ **Post date:** [May 6, 2026, 8:33pm UTC](https://forum.zcashcommunity.com/t/zf-engineering-update-april-20th-may-3rd-2026/55618/1 "2026-05-06T20:33:48Z")
In the past two weeks, we have released [Zebra v4.4.1](https://github.com/ZcashFoundation/zebra/releases/tag/v4.4.1) and [FROST v3.0.0](https://github.com/ZcashFoundation/frost/releases/tag/frost-core%2Fv3.0.0). Zebra was shipped with a batch of fixes addressing memory allocation issues during block deserialization, several RPC vulnerabilities, and bugs in the script and sighash validation code. ## CI & Infrastructure We added a [new benchmark suite](https://github.com/ZcashFoundation/zebra/pull/10444) to Zebra using the Criterion benchmarking library, covering Sprout, Sapling, and Orchard proof verification, and transaction serialization across all supported formats. We also added a CI workflow that runs benchmarks on demand and compares results across pull requests. We then [followed up with refinements](https://github.com/ZcashFoundation/zebra/pull/10501) to align the benchmark group names with the labels used in our production metrics, reduce duplicated code across the suite, and raise the noise threshold to keep CI results stable. We [aligned Zebra’s Sentry observability setup](https://github.com/ZcashFoundation/zebra/pull/10490) so that the running version and environment are tracked consistently across GitHub Actions, GCP, and Sentry. We also [fixed the cargo-vet supply chain audit state](https://github.com/ZcashFoundation/zebra/pull/10504) that had drifted after the previous release. ## Zebra The majority of engineering work this sprint went into security fixes, all of which were bundled into the [Zebra v4.4.1 release](https://github.com/ZcashFoundation/zebra/releases/tag/v4.4.1). We [enforced the protocol’s 160-entry cap on block header messages](https://github.com/ZcashFoundation/zebra/pull/10528) in the network layer’s header-reading code, and we fixed several places in Zebra’s block and transaction deserializers where untrusted length fields were being used to allocate memory before the data was validated: this affected [coinbase data size](https://github.com/ZcashFoundation/zebra/pull/10526), the [Equihash solution size field](https://github.com/ZcashFoundation/zebra/pull/10525), and [Sapling spend vectors inside coinbase transactions](https://github.com/ZcashFoundation/zebra/pull/10527). We also fixed [a stale sighash bug in the script validator](https://github.com/ZcashFoundation/zebra/pull/10524) where the output buffer was not filled correctly on failure, which could have allowed invalid signatures to slip through, and we fixed [a panic risk in the transparent script verifier](https://github.com/ZcashFoundation/zebra/pull/10510), where an out-of-range input index or a mismatched output vector length would crash rather than return an error. Beyond security, we [cleaned up the remaining Groth16 abstractions](https://github.com/ZcashFoundation/zebra/pull/10436) left over from Zebra’s earlier Sapling migration. On the RPC side, we fixed [four separate security issues](https://github.com/ZcashFoundation/zebra/pull/10523): the RPC cookie file now gets strict file permissions, and symlinks at the cookie path are rejected; HTTP request body sizes are bounded before reading; slow gRPC consumers are now dropped rather than buffered; and `getrawtransaction` was corrected to use the block hash supplied by the caller. We also fixed [a bug in `getrawtransaction` confirmation counts](https://github.com/ZcashFoundation/zebra/pull/10507). ## Other Repos In the FROST repository, we [published the v3.0.0 release](https://github.com/ZcashFoundation/frost/pull/1041). We also [added an optional zcashd compose profile](https://github.com/ZcashFoundation/z3/pull/33) to the [ZcashFoundation/z3](https://github.com/ZcashFoundation/z3) repository, making it easier to run zcashd alongside the other node configurations already provided. ## External Contributions Thank you to [@schell](https://github.com/schell) for [updating Zebra’s librustzcash dependencies](https://github.com/ZcashFoundation/zebra/pull/10522) and [@daira](https://github.com/daira) for [adding the nTx field to Zebra’s getblock RPC](https://github.com/ZcashFoundation/zebra/pull/10498). _Thanks for reading!_