Zebra: Consensus divergence in V5 transparent signature verification
Summary
Zebra before 4.4.0 computes a ZIP-244 digest for SIGHASH_SINGLE inputs that have no matching output, instead of rejecting them. An attacker can craft a V5 transaction with fewer outputs than inputs that Zebra accepts into its mempool and includes in block templates, while zcashd rejects it. If an external miner includes such a transaction in a block, the node network splits, and no confidentiality impact is expected.
Affected
- Zebra (zebrad) versions before 4.4.0
- Per the related advisory GHSA-pvmv-cwg8-v6c8, zebrad 4.4.0 and zebra-script 6.0.0 are also affected by a closely related ZIP-244 issue
Fixed in
- Zebra 4.4.1 or later (according to the related advisory GHSA-pvmv-cwg8-v6c8, which states that 4.4.0 does not cover this specific case)
- OSV and the CVE data list 4.4.0 as the fixed version; this conflicts with the related advisory
Workaround
Unknown. No documented workaround was found. Upgrading is the only documented remedy.
Exploitation
- Public proof of concept: reproduction steps are published in the GitHub advisory
- CISA SSVC: exploitation 'poc', not automatable, total technical impact
- No evidence of exploitation in the wild was found
- EPSS 0.00205 (per Vulners)
Our recommendation
- Upgrade Zebra to version 4.4.1 or later immediately, and check the releases page for the newest version
- If Zebra runs as a Zcash node, miner or block-template source, check whether it is exposed and monitor its logs and chain consistency with zcashd
- Verify that the patched version runs on the correct consensus path
- If Zebra is not used in the organisation, no action is needed
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-cwfq-rfcr-8hmp github.com
- VulnCheck advisory www.vulncheck.com
- GitHub Security Advisory GHSA-pvmv-cwg8-v6c8 (related) github.com
- OSV CVE-2026-104437 osv.dev
- OSV GHSA-cwfq-rfcr-8hmp osv.dev
- Zebra release v4.4.0 github.com
- Vulners VulnCheck record CVE-2026-104437 vulners.com
- DevGuard GHSA-cwfq-rfcr-8hmp docs.devguard.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 14:23.
Original description (NVD)
Zebra before 4.4.0 contains a consensus divergence vulnerability in V5 transparent signature verification, computing a ZIP-244 digest for SIGHASH_SINGLE inputs lacking corresponding outputs instead of failing. Attackers can craft V5 transactions with fewer outputs than inputs that Zebra accepts and templates via getblocktemplate, producing blocks zcashd rejects.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.