Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.3

Zebra before 4.4.0 may accept malformed Zcash blocks

CVE-2026-104437 · published 13 days ago
Summary

Versions of Zebra prior to 4.4.0 can incorrectly treat certain transaction signatures as valid, allowing specially crafted transactions with mismatched inputs and outputs. This can cause Zebra to build blocks that other Zcash software will reject, disrupting network consensus. Update Zebra to version 4.4.0 or newer to prevent the issue.

What to do
  • Update zcashfoundation zebra to version 4.4.0 or later.
Affected software
VendorProductAffected versions
zcashfoundation zebra < 4.4.0
Original advisory text
Zebra before 4.4.0 Consensus Split via SIGHASH_SINGLE Missing-Output Handling
Zebra before 4.4.0 contains a consensus divergence vulnerability in V5 transparent signature verification, computing a ZIP-244 digest for SIGHASH_SINGLE inputs lacking corresponding outputs instead of failing. Attackers can craft V5 transactions with fewer outputs than inputs that Zebra accepts and templates via getblocktemplate, producing blocks zcashd rejects.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.3 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-347Improper Verification of Cryptographic Signature
Timeline
Published2 Oct 2026
Updated14 Oct 2026
First seen2 Oct 2026
Sources
CVE-2026-104437 · NVD
CVE-2026-104437 · MITRE
Track software like this
Free during beta