{"id":"EUVD-2026-91447","enisaUuid":"47b42208-764d-3a3b-a01c-b4c2af7f3459","description":"Zebra before 4.4.0 contains a consensus divergence vulnerability in V5 transparent signature verification, computing a ZIP-244 digest for SIGHASH_SINGLE inputs lacking corresponding outputs instead of failing. Attackers can craft V5 transactions with fewer outputs than inputs that Zebra accepts and templates via getblocktemplate, producing blocks zcashd rejects.","datePublished":"Oct 2, 2026, 11:38:13 AM","dateUpdated":"Oct 6, 2026, 2:42:57 AM","baseScore":8.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-cwfq-rfcr-8hmp\nhttps://www.vulncheck.com/advisories/zebra-before-4.4.0-consensus-split-via-sighash-single-missing-output-handling\n","aliases":"CVE-2026-104437\nGHSA-wc6w-gfmg-rf5p\n","assigner":"VulnCheck","epss":0.25,"enisaIdProduct":[{"id":"dedebcdf-0fe3-3a8f-baec-07ba4a5569e8","product":{"name":"zebra","vendor":{"name":"ZcashFoundation"}},"product_version":"0 \u003c4.4.0"}],"enisaIdVendor":[{"id":"81d2971c-c25e-3d22-bb23-552d23a52ce3","vendor":{"name":"ZcashFoundation"}}],"enisaIdVulnerability":[{"id":"95b3c37e-73d9-3ac5-b59d-f006fd82a67d","vulnerability":{"id":"GHSA-wc6w-gfmg-rf5p","description":"Zebra before 4.4.0 contains a consensus divergence vulnerability in V5 transparent signature verification, computing a ZIP-244 digest for SIGHASH_SINGLE inputs lacking corresponding outputs instead of failing. Attackers can craft V5 transactions with fewer outputs than inputs that Zebra accepts and templates via getblocktemplate, producing blocks zcashd rejects.","datePublished":"Oct 2, 2026, 12:31:15 PM","dateUpdated":"Oct 2, 2026, 12:31:15 PM","baseScore":0.0,"references":"https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-cwfq-rfcr-8hmp\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-104437\nhttps://www.vulncheck.com/advisories/zebra-before-4.4.0-consensus-split-via-sighash-single-missing-output-handling\n","enisa_id":"EUVD-2026-91447\n","aliases":"GHSA-wc6w-gfmg-rf5p\nCVE-2026-104437\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:54:29 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"aa99ef2a-d7e1-3617-aee9-630f801b8c10","vulnerability":{"id":"CVE-2026-104437","description":"Zebra before 4.4.0 contains a consensus divergence vulnerability in V5 transparent signature verification, computing a ZIP-244 digest for SIGHASH_SINGLE inputs lacking corresponding outputs instead of failing. Attackers can craft V5 transactions with fewer outputs than inputs that Zebra accepts and templates via getblocktemplate, producing blocks zcashd rejects.","datePublished":"Oct 2, 2026, 11:38:13 AM","dateUpdated":"Oct 6, 2026, 2:42:57 AM","status":"PUBLISHED","baseScore":8.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-cwfq-rfcr-8hmp\nhttps://www.vulncheck.com/advisories/zebra-before-4.4.0-consensus-split-via-sighash-single-missing-output-handling\n","enisa_id":"EUVD-2026-91447\n","assigner":"VulnCheck","epss":0.25,"dataProcessed":"Nov 11, 2026, 7:21:11 AM","vulnerabilityProduct":[{"id":"d4b9b454-13e9-388f-9354-f7f2ad2ace48","product":{"name":"zebra","vendor":{"name":"ZcashFoundation"}},"product_version":"0 \u003c4.4.0"}],"vulnerabilityVendor":[{"id":"2d8cfd81-bbe6-3f3e-a786-46cafa5d7e3e","vendor":{"name":"ZcashFoundation"}}]}}],"enisaIdAdvisory":[]}