CVE-2026-104437

HIGHCVSS 7.4

Description

Zebra before 4.4.0 contains a consensus divergence vulnerability in V5 transparent signature verification, computing a ZIP-244 digest for SIGHASH_SINGLE inputs lacking corresponding outputs instead of failing. Attackers can craft V5 transactions with fewer outputs than inputs that Zebra accepts and templates via getblocktemplate, producing blocks zcashd rejects.

Timeline

Published:October 2nd, 2026 12:17 PM

Last modified:October 6th, 2026 3:17 AM

CVSS Scoring

CVSS v3: 7.4 (HIGH)

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

Weaknesses (CWE)

CWE-347

References & Reports

Advisories, patches, and third-party reports

https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-cwfq-rfcr-8hmp
https://www.vulncheck.com/advisories/zebra-before-4.4.0-consensus-split-via-sighash-single-missing-output-handling
https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-cwfq-rfcr-8hmp

Source: NIST NVD · Data may lag official sources by up to one minute