Executive brief
Zebra v4.4.0 still accepts V5 SIGHASH_SINGLE without a corresponding output
Affected products
- crates.io zebra-script
- crates.io zebrad
Junglewise Threat Intelligence
Zebra v4.4.0 still accepts V5 SIGHASH_SINGLE without a corresponding output
Severity: medium · CVSS 4 · Published 2026-05-08
Technologies: zebra-script (crates.io), zebrad (crates.io). Vendors: crates.io.
Related threats
- ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, an unauthenticated IPv4 peer can deterministically terminate a synced Zebra
- ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a malicious block producer can terminate zebrad by placing the same shielded
- ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a consensus-valid block containing a long chain of transparent self-spends t
- ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a malicious unauthenticated P2P peer can answer Zebra's outbound getblocks o
- ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a remote unauthenticated P2P peer can stall a Zebra node by racing an invali