Zebra before 4.4.0 Consensus Split via SIGHASH_SINGLE Missing-Output Handling
Priority HIGH 71CWE-347Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-347.
Summary
Zebra before 4.4.0 contains a consensus divergence vulnerability in V5 transparent signature verification, computing a ZIP-244 digest for SIGHASH_SINGLE inputs lacking corresponding outputs instead of failing. Attackers can craft V5 transactions with fewer outputs than inputs that Zebra accepts and templates via getblocktemplate, producing blocks zcashd rejects.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00247 16th percentileScored 2026-11-07
Fix Fixed zebra (ZcashFoundation): 4.4.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ZcashFoundation | zebra | before 4.4.0 | 4.4.0 | Patch available | CNA |
- zebra VendorZcashFoundation Affected before 4.4.0 Fixed in 4.4.0 Patch available CNA
Remediation
- Fix · CNA zebra (ZcashFoundation) Fixed in 4.4.0
Timeline
- 2026-10-02 Threatist record created from CVE-2026-104437
- 2026-10-03 Alias added: GHSA-wc6w-gfmg-rf5p
- 2026-10-04 Priority changed: MEDIUM → LOW
- 2026-10-06 CISA SSVC decision points changed
- 2026-10-06 Priority changed: LOW → HIGH
References
More ZcashFoundation vulnerabilities
- TI-2026-37850 ZEBRA: Mempool transaction admission denial via single-peer inbound queue saturation CVSS 3.1MEDIUM 5.3
- TI-2026-71182 Improper block validation in Zebra gossip lets peers drop new blocks CVSS 4.0MEDIUM 6.3
- TI-2026-29537 Zebra: addr/addrv2 Deserialization Resource Exhaustion CVSS 4.0MEDIUM 6.3
- TI-2026-30136 ZEBRA: Consensus Divergence in Transparent Sighash Hash-Type Handling CVSS 4.0CRITICAL 9.3
- TI-2026-37853 ZEBRA: Consensus divergence via P2SH sigop undercount in pure-Rust disabled-opcode parser CVSS 4.0CRITICAL 9.3
- TI-2026-32432 ZEBRA: Block Validator Undercounts Coinbase and P2SH Sigops CVSS 4.0CRITICAL 9.2
Sources
- CVE-2026-104437 · CVE Program
- CVE-2026-104437 · NVD
- FIRST EPSS
- GHSA-wc6w-gfmg-rf5p · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences