Skip to content
CVE PROGRAM SOURCE RECORD8.3 High

CVE-2026-104435

Zebra 4.4.0 Consensus Divergence via V5 SIGHASH_SINGLE Without Output

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Zebra zebrad 4.4.0 and zebra-script 6.0.0 fail to enforce a ZIP-244 consensus rule, accepting V5 transparent inputs signed with SIGHASH_SINGLE that lack a corresponding output. Attackers can broadcast crafted V5 transactions with more inputs than outputs that Zebra accepts but zcashd rejects, causing a network consensus split.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

ZcashFoundation zebra

Default version status: unaffected

  • 4.4.0 to < 4.4.1affected
  • 4.4.1unaffected
pkg:cargo/zebrad

ZcashFoundation zebra

Default version status: unaffected

  • 6.0.0 to < 6.0.1affected
  • 6.0.1unaffected
pkg:cargo/zebra-script

References