CVE-2026-104437 Zebra before 4.4.0 Consensus Split via SIGHASH_SINGLE Missing-Output Handling
Attackers can cause consensus divergence by crafting invalid transactions, leading to network partitioning or denial of service in Zebra nodes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-104437?
CVE-2026-104437 is a high-severity vulnerability in ZcashFoundation zebra, published on 2 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Zebra before 4.4.0 contains a consensus divergence vulnerability in V5 transparent signature verification, computing a ZIP-244 digest for SIGHASH_SINGLE inputs lacking corresponding outputs instead of failing. Attackers can craft V5 transactions with fewer outputs than inputs that Zebra accepts and templates via getblocktemplate, producing blocks zcashd rejects.
Weakness: CWE-347
Which versions are affected by CVE-2026-104437?
2 open source packages ship an affected version, including zebrad.
| Package | Affected | Fixed in |
|---|---|---|
zebrad crates.io | All versions | 4.4.0 |
zebrad crates.io | All versions | 4.4.0 |
How do I fix CVE-2026-104437?
Upgrade zebrad to 4.4.0 or later.
Is CVE-2026-104437 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-104437 exists.
Sources
Also known as GHSA-cwfq-rfcr-8hmp, GHSA-wc6w-gfmg-rf5p.