Consensus Issue in Zebra's Zebrad and Zebra-Script Products by Zcash Foundation
CVE-2026-104435

8.3HIGH

Key Information:

Vendor

Zcashfoundation

Status
Zebra
Vendor
CVE Published:
2 October 2026

What is CVE-2026-104435?

Zebra's Zebrad version 4.4.0 and Zebra-Script version 6.0.0 are vulnerable due to improper enforcement of ZIP-244 consensus rules. This flaw allows attackers to create and broadcast specially crafted V5 transactions that include more inputs than outputs, which Zebrad accepts but the zcashd implementation rejects. As a result, this discrepancy may lead to a network consensus split, posing significant risks to the integrity and stability of the network. Users are advised to follow best practices and monitor the latest updates from the Zcash Foundation.

Affected Version(s)

zebra 4.4.0 < 4.4.1

zebra 6.0.0 < 6.0.1

zebra 4.4.1

References

https://github.com/ZcashFoundation/zebra/security/advisor...
vendor-advisory
https://www.vulncheck.com/advisories/zebra-4.4.0-consensu...
third-party-advisory

CVSS V4

Score:
8.3
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

sangsoo-osec
fivelittleducks
.