# Zcash Zebra consensus divergence in SIGHASH_SINGLE handling

Source: https://junglewise.ai/threats/zcash-zebra-consensus-divergence-in-sighash-single-handling-8969cdaa  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-07. Updated: 2026-05-18  
License: CC BY 4.0 with a link back

Severity: critical · CVSS 9.2 · Published 2026-05-07

Zebra is a Rust-based implementation of a Zcash node. A vulnerability in how it handles specific transaction signatures (SIGHASH_SINGLE) allows it to accept transactions that other Zcash nodes (zcashd) would reject. This creates a 'consensus split' where the network disagrees on which transactions and blocks are valid, potentially leading to financial discrepancies, service disruptions, and a loss of trust in the network's integrity.

Technologies: [zebrad (crates.io)](https://junglewise.ai/threats/technologies/zebrad), [Zcash Foundation Zebra](https://junglewise.ai/threats/technologies/zebra). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io), [Zcash Foundation](https://junglewise.ai/threats/vendors/zcash-foundation).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Critical severity, with a CVSS score of 9.2, published 7 May 2026.

**Which products and versions are affected?** zebrad (crates.io) < 4.4.0; Zcash Foundation Zebra < 4.4.0.

**Is there a fix for This vulnerability?** A patch was published on 2026-05-07: Fixed in version 4.4.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run zebrad (crates.io) or Zcash Foundation Zebra at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A consensus divergence exists in Zebra's handling of ZIP-244 (V5+) transparent spends. When a transaction uses SIGHASH_SINGLE and the input index has no corresponding output, zcashd correctly fails validation. However, Zebra's transparent verification path computes a digest for the missing-output case instead of returning an error. An attacker can exploit this by crafting a V5 transaction with fewer outputs than inputs and signing the digest Zebra expects. This allows Zebra to accept, mempool, and mine blocks containing transactions that the rest of the Zcash network (running zcashd) will reject, resulting in a chain split. The issue is fixed in Zebra version 4.4.0.

## Affected products

- ZcashFoundation zebrad < 4.4.0

## Timeline

- 2026-05-02: disclosed: Advisory published by Zcash Foundation
- 2026-05-07: advisory: GitHub Advisory published
- 2026-05-07: patched: Fixed in version 4.4.0

## References

- [https://api.github.com/users/sangsoo-osec](https://api.github.com/users/sangsoo-osec)
- [https://github.com/sangsoo-osec](https://github.com/sangsoo-osec)
- [https://api.github.com/users/sangsoo-osec/gists%7B/gist_id%7D](https://api.github.com/users/sangsoo-osec/gists%7B/gist_id%7D)
- [https://api.github.com/users/sangsoo-osec/repos](https://api.github.com/users/sangsoo-osec/repos)
- [https://avatars.githubusercontent.com/u/129559837?v=4](https://avatars.githubusercontent.com/u/129559837?v=4)
- [https://api.github.com/users/sangsoo-osec/events%7B/privacy%7D](https://api.github.com/users/sangsoo-osec/events%7B/privacy%7D)

## Related threats

- [Zebra incomplete cleanup in checkpoint sync stalls initial sync](https://junglewise.ai/threats/cve-2026-123560-zebra-before-7-0-0-contains-an-incomplete-cleanup-vulnerability)
- [Zebra denial of service via quadratic sighash computation](https://junglewise.ai/threats/cve-2026-123559-zebra-before-7-0-0-contains-an-inefficient-algorithmic)
- [Zcash Foundation Zebra zebrad reachable assertion denial of service](https://junglewise.ai/threats/cve-2026-123557-zcashfoundation-zebra-zebrad-before-7-0-0-contains-a-reachable)
- [Zcash Foundation Zebra protection mechanism failure in mempool lock-time scoring](https://junglewise.ai/threats/cve-2026-123556-zcashfoundation-zebra-from-4-5-0-before-7-0-0-contains-a)
- [Zebra misbehavior scoring bypass via invalid script verification](https://junglewise.ai/threats/cve-2026-123555-zebra-from-2-3-0-before-7-0-0-contains-a-denial-of-service)