CVE-2026-104437 — Zebra before 4.4.0 Consensus Split via SIGHASH_SINGLE Missing-Output Handling
Zebra before 4.4.0 contains a consensus divergence vulnerability in V5 transparent signature verification, computing a ZIP-244 digest for SIGHASH_SINGLE inputs lacking correspon…
Published: 2026-10-02 · CVSS: 8.3 · CVSS 4.0
Zebra before 4.4.0 contains a consensus divergence vulnerability in V5 transparent signature verification, computing a ZIP-244 digest for SIGHASH_SINGLE inputs lacking corresponding outputs instead of failing. Attackers can craft V5 transactions with fewer outputs than inputs that Zebra accepts and templates via getblocktemplate, producing blocks zcashd rejects.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7