Consensus Divergence Vulnerability in Zebra by Zcash Foundation
CVE-2026-104437

8.3HIGH

Key Information:

Vendor

Zcashfoundation

Status
Zebra
Vendor
CVE Published:
2 October 2026

What is CVE-2026-104437?

Zebra versions before 4.4.0 are affected by a vulnerability in the V5 transparent signature verification process. This flaw allows an attacker to craft transactions with an incorrect number of outputs for SIGHASH_SINGLE inputs, which Zebra improperly accepts. As a result, blocks can be generated that the Zcash daemon (zcashd) will reject, leading to potential consensus divergence within the blockchain. It's crucial for users of affected Zebra versions to update to mitigate this risk.

Affected Version(s)

zebra 0 < 4.4.0

zebra 4.4.0

References

https://github.com/ZcashFoundation/zebra/security/advisor...
vendor-advisory
https://www.vulncheck.com/advisories/zebra-before-4.4.0-c...
third-party-advisory

CVSS V4

Score:
8.3
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

sangsoo-osec
defuse
mpguerra
upbqdn
.