CVE Feed

    Dashboard / CVE / CVE-2026-104437

    CVE-2026-104437

    Zebra before 4.4.0 contains a consensus divergence vulnerability in V5 transparent signature verification, computing a ZIP-244 digest for SIGHASH_SINGLE inputs lacking corresponding outputs instead of failing. Attackers can craft V5 transactions with fewer outputs than inputs that Zebra accepts and templates via getblocktemplate, producing blocks zcashd rejects.

    Published:Oct 2, 2026
    Last Modified:Oct 6, 2026
    EPS:Oct 2, 2026
    EPSS Score:0.00205
    CVSS Score:7.4

    Affected Products

    Vendor
    Zcashfoundation
    Product
    Zebra
    Vendor
    Zfnd
    Product
    Zebra

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-463 Padding Oracle Crypto Attack
    CAPEC-475 Signature Spoofing by Improper Validation

    Related CVEs

    CVE-2026-109366 (CVSS 6.3) — Zebra before 6.4.0 contains an improper integrity validation vulnerability in the inbound gossip download path…
    CVE-2026-109365 (CVSS 6.3) — Zebra before 6.4.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated pee…
    CVE-2026-109364 (CVSS 6.9) — Zebra 2.3.0 before 6.4.0 contains a protection mechanism failure that allows unauthenticated peers to evade ba…
    CVE-2026-109363 (CVSS 8.7) — ZcashFoundation Zebra 6.4.0 before 6.4.2 parses version 6 transactions carrying a pre-NU6.3 consensus branch I…
    CVE-2026-104436 (CVSS 6.3) — Zebra before 4.5.0 contains an uncontrolled resource consumption vulnerability that allows remote P2P peers to…
    CVE-2026-104435 (CVSS 8.3) — Zebra zebrad 4.4.0 and zebra-script 6.0.0 fail to enforce a ZIP-244 consensus rule, accepting V5 transparent i…
    CVE-2026-104434 (CVSS 7.1) — ZcashFoundation Zebra zebra-rpc before 8.0.0 and zebrad before 4.5.0 contain a reachable assertion in the z_li…
    CVE-2026-104432 (CVSS 6.9) — Zebra before 6.3.0 contains an improper exceptional condition check in ChainSync::obtain_tips that discards va…
    CVE-2026-104431 (CVSS 8.7) — Zebra before 6.0.0 contains a denial of service vulnerability that allows unauthenticated peers to stall Tokio…
    CVE-2026-104430 (CVSS 8.7) — Zebra zebrad 4.5.0 and zebra-script 7.0.0 count P2SH redeem script signature operations in legacy mode rather …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High