Search/CVE-2026-104437
● CVE — High

CVE-2026-104437

DiscoveredOct 2, 2026UpdatedOct 6, 2026

Zebra before 4.4.0 contains a consensus divergence vulnerability in V5 transparent signature verification, computing a ZIP-244 digest for SIGHASH_SINGLE inputs lacking corresponding outputs instead of failing. Attackers can craft V5 transactions with fewer outputs than inputs that Zebra accepts and templates via getblocktemplate, producing blocks zcashd rejects.

CVSS v3.1
7.4 HIGH
EPSS
0.25%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
0
sources referencing this CVE
Related IOCs
0
seen in the same coverage
EPSS Trend
Oct 4, 2026 → Oct 26, 2026
▲ 0.04pp
0.21% → 0.25% over 2 tracked changes
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityHIGH
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
ConfidentialityNONE
IntegrityHIGH
AvailabilityHIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Connections
1 relationships
Timeline
disclosure → media coverage
Oct 2, 2026
Disclosure — published as a CVE record. · last revised by NVD Oct 6, 2026