CVE-2026-104437

7.4 HIGHpublic exploit available

Published 2026-10-02 · Updated 2026-10-06

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Zebra before 4.4.0 contains a consensus divergence vulnerability in V5 transparent signature verification, computing a ZIP-244 digest for SIGHASH_SINGLE inputs lacking corresponding outputs instead of failing. Attackers can craft V5 transactions with fewer outputs than inputs that Zebra accepts and templates via getblocktemplate, producing blocks zcashd rejects.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

Weaknesses

CWE-347

Public exploit & PoC references

https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-cwfq-rfcr-8hmp
https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-cwfq-rfcr-8hmp

All references

https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-cwfq-rfcr-8hmp
https://www.vulncheck.com/advisories/zebra-before-4.4.0-consensus-split-via-sighash-single-missing-output-handling
https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-cwfq-rfcr-8hmp

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2025-71422PoC
HIGHCVE-2026-100293
HIGHCVE-2026-102266PoC
CRITICALCVE-2026-102268PoC
HIGHCVE-2026-102271PoC
HIGHCVE-2026-102272PoC
HIGHCVE-2026-102273PoC
MEDIUMCVE-2026-102502

Related by shared AI tags and CWE weakness class. Browse the full archive.