All vulnerabilities
CVE-2026-104435GHSA-pvmv-cwg8-v6c8

Zebra 4.4.0 Consensus Divergence via V5 SIGHASH_SINGLE Without Output

ZcashFoundation zebracrates.ioLibraries & packages
Open in ThreatlineRecord JSON
CVSS
8.3High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4.4.1Also 6.0.1CVE List
Published2 Oct 2026Updated 3 Oct 2026CVE List

What fixes it

  • 4.4.1zebraCVE List
  • 6.0.1zebraCVE List
  • 4.4.1zebrad, crates.ioOSVcargo update -p zebrad --precise 4.4.1
  • 6.0.1zebra-script, crates.ioOSVcargo update -p zebra-script --precise 6.0.1

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Zebra zebrad 4.4.0 and zebra-script 6.0.0 fail to enforce a ZIP-244 consensus rule, accepting V5 transparent inputs signed with SIGHASH_SINGLE that lack a corresponding output. Attackers can broadcast crafted V5 transactions with more inputs than outputs that Zebra accepts but zcashd rejects, causing a network consensus split.

Text from CVE List

Affected versions 6

  • zebraaffected: 4.4.0 before 4.4.1CVE List
  • zebraunaffected: 4.4.1CVE List
  • zebraaffected: 6.0.0 before 6.0.1CVE List
  • zebraunaffected: 6.0.1CVE List
  • zebrad, crates.iofrom first release, fixed in 4.4.1OSV
  • zebra-script, crates.iofrom first release, fixed in 6.0.1OSV

References 2