EUVD-2026-91445

Zebra zebrad 4.4.0 and zebra-script 6.0.0 fail to enforce a ZIP-244 consensus rule, accepting V5 transparent inputs signed with SIGHASHSINGLE that lack a corresponding output. Attackers can broadcast crafted V5 transactions with more inputs than outputs that Zebra accepts but zcashd rejects,...

CVE-2026-104435

Zebra zebrad 4.4.0 and zebra-script 6.0.0 are vulnerable to a consensus rule enforcement failure. The software fails to correctly apply the ZIP-244 consensus rule , specifically by accepting V5 transparent inputs signed with SIGHASH_SINGLE that do not have a corresponding output. This flaw allows...

EUVD-2026-91441

Zebra zebrad 4.5.0 and zebra-script 7.0.0 count P2SH redeem script signature operations in legacy mode rather than zcashd's accurate P2SH mode, overcounting CHECKMULTISIG preceded by OP1 through OP16 as 20 sigops and causing a consensus divergence. Remote attackers can broadcast P2SH spends using...

CVE-2026-104430

The software zebra zebrad 4.5.0 and zebra-script 7.0.0 contains a vulnerability where P2SH redeem script signature operations are counted in legacy mode instead of the accurate P2SH mode used by zcashd . This causes CHECKMULTISIG preceded by OP_1 through OP_16 to be overcounted as 20 sigops, lead...

CVE-2026-104430: Function Call with Incorrectly Specified Arguments

Zebra zebrad 4.5.0 and zebra-script 7.0.0 count P2SH redeem script signature operations in legacy mode rather than zcashd's accurate P2SH mode, overcounting CHECKMULTISIG preceded by OP1 through OP16 as 20 sigops and causing a consensus divergence. Remote attackers can broadcast P2SH spends using...

PT-2026-104230

Name of the Vulnerable Software and Affected Versions Zebra zebrad versions 4.5.0 through 6.2.0 Description The software fails to track which peer supplied block hashes in FindBlocks responses. It assigns 100 misbehavior points, which is the ban threshold, to any peer that serves a requested bloc...

Zebra Address Book Aborted by IPv4-Mapped Mempool Misbehavior Update

Am I affected You are affected if: 1. You run zebrad up to and including v4.4.1. 2. Your node listens on the default :: address on a Linux host the standard deployment configuration — net.ipv6.bindv6only=0 is the default on all common Linux distributions. 3. Your node is synced near the chain tip...