Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.3
CVE-2026-104435: Zebra 4.4.0 can cause network split with crafted transactions
CVE-2026-104435 · published 13 days ago
Summary
The Zebra software version 4.4.0 (and its scripting component 6.0.0) does not correctly follow a rule for certain Zcash transactions, allowing specially crafted transactions to be accepted by Zebra but rejected by other Zcash nodes. This mismatch can split the network into two groups that do not agree on which transactions are valid. Updating to a version that fixes the rule or disabling the affected transaction type will prevent the split.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| zcashfoundation | zebra |
< 4.4.1 < 6.0.1 |
Original advisory text
Zebra 4.4.0 Consensus Divergence via V5 SIGHASH_SINGLE Without Output
Zebra zebrad 4.4.0 and zebra-script 6.0.0 fail to enforce a ZIP-244 consensus rule, accepting V5 transparent inputs signed with SIGHASH_SINGLE that lack a corresponding output. Attackers can broadcast crafted V5 transactions with more inputs than outputs that Zebra accepts but zcashd rejects, causing a network consensus split.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
8.3
High
Type
CWE-347Improper Verification of Cryptographic Signature
Timeline
Published2 Oct 2026
Updated14 Oct 2026
First seen2 Oct 2026
Track software like this
Free during beta