What is GHSA-wc6w-gfmg-rf5p?

GHSA-wc6w-gfmg-rf5p is a security advisory published by GitHub Security Advisories with High severity. Zebra before 4.4.0 contains a consensus divergence vulnerability in V5 transparent signature...

Which CVE IDs does GHSA-wc6w-gfmg-rf5p cover?

GHSA-wc6w-gfmg-rf5p covers the following CVE IDs: CVE-2026-104437. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-wc6w-gfmg-rf5p?

GHSA-wc6w-gfmg-rf5p has a CVSS v3 base score of 7.4, published by GitHub Security Advisories.

GHSA-wc6w-gfmg-rf5pHighCVSS 7.4

Zebra before 4.4.0 contains a consensus divergence vulnerability in V5 transparent signature...

Vendor

GitHub Security Advisories

Published

October 2, 2026

Last Modified

October 2, 2026

🔗 CVE IDs covered (1)

CVE-2026-104437 →

📋 Description

Zebra before 4.4.0 contains a consensus divergence vulnerability in V5 transparent signature verification, computing a ZIP-244 digest for SIGHASH_SINGLE inputs lacking corresponding outputs instead of failing. Attackers can craft V5 transactions with fewer outputs than inputs that Zebra accepts and templates via getblocktemplate, producing blocks zcashd rejects.

🔗 References (4)

https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-cwfq-rfcr-8hmp
https://nvd.nist.gov/vuln/detail/CVE-2026-104437
https://www.vulncheck.com/advisories/zebra-before-4.4.0-consensus-split-via-sighash-single-missing-output-handling
https://github.com/advisories/GHSA-wc6w-gfmg-rf5p