Zebra 4.4.0 Consensus Divergence via V5 SIGHASH_SINGLE Without Output
Priority LOW 35CWE-347Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-347.
Summary
Zebra zebrad 4.4.0 and zebra-script 6.0.0 fail to enforce a ZIP-244 consensus rule, accepting V5 transparent inputs signed with SIGHASH_SINGLE that lack a corresponding output. Attackers can broadcast crafted V5 transactions with more inputs than outputs that Zebra accepts but zcashd rejects, causing a network consensus split.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00205 10th percentileScored 2026-11-07
Fix Fixed zebra (ZcashFoundation): 4.4.1, 6.0.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ZcashFoundation | zebra | 4.4.0 to before 4.4.1 | 4.4.1 | Patch available | CNA |
| ZcashFoundation | zebra | 6.0.0 to before 6.0.1 | 6.0.1 | Patch available | CNA |
- zebra VendorZcashFoundation Affected 4.4.0 to before 4.4.1 Fixed in 4.4.1 Patch available CNA
- zebra VendorZcashFoundation Affected 6.0.0 to before 6.0.1 Fixed in 6.0.1 Patch available CNA
Remediation
- Fix · CNA zebra (ZcashFoundation) Fixed in 4.4.1
- Fix · CNA zebra (ZcashFoundation) Fixed in 6.0.1
Timeline
- 2026-10-02 Threatist record created from CVE-2026-104435
- 2026-10-03 Alias added: GHSA-gm38-j348-x4mq
References
More ZcashFoundation vulnerabilities
- TI-2026-66079 Zebra before 4.4.0 Consensus Split via SIGHASH_SINGLE Missing-Output Handling CVSS 4.0HIGH 8.3
- TI-2026-37850 ZEBRA: Mempool transaction admission denial via single-peer inbound queue saturation CVSS 3.1MEDIUM 5.3
- TI-2026-71182 Improper block validation in Zebra gossip lets peers drop new blocks CVSS 4.0MEDIUM 6.3
- TI-2026-29537 Zebra: addr/addrv2 Deserialization Resource Exhaustion CVSS 4.0MEDIUM 6.3
- TI-2026-30136 ZEBRA: Consensus Divergence in Transparent Sighash Hash-Type Handling CVSS 4.0CRITICAL 9.3
- TI-2026-37853 ZEBRA: Consensus divergence via P2SH sigop undercount in pure-Rust disabled-opcode parser CVSS 4.0CRITICAL 9.3
Sources
- CVE-2026-104435 · CVE Program
- CVE-2026-104435 · NVD
- FIRST EPSS
- GHSA-gm38-j348-x4mq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences