-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

0xCERT Security Advisory 0xCERT-2026-0195
============================================================

Advisory-ID:  0xCERT-2026-0195
Severity:     Critical
Published:    2026-05-08T18:27:26.000Z
Updated:      2026-10-08T22:47:30.355Z
Chains:       n/a
URL:          https://www.0xcert.com/advisory/0xCERT-2026-0195

Title: Zebra v4.4.0 still accepts V5 SIGHASH_SINGLE without a corresponding output

Summary
- -------
Zebra v4.4.0 still accepts V5 SIGHASH_SINGLE without a corresponding output. Zebra failed to enforce a ZIP-244 consensus rule for V5 transparent transactions: when an input is signed with SIGHASHSINGLE and there is no transparent output at the same index as that input, validation must fail.

Details
- -------
Summary
Zebra failed to enforce a ZIP-244 consensus rule for V5 transparent transactions: when an input is signed with SIGHASHSINGLE and there is no transparent output at the same index as that input, validation must fail.

Affected
- - zebrad (rust) < 4.4.1 — fixed in 4.4.1
- - zebra-script (rust) < 6.0.1 — fixed in 6.0.1

Severity
Critical (CVSS 9.3), as rated by the upstream advisory.

Recommended actions
- - Upgrade zebrad to 4.4.1 or later
- - Upgrade zebra-script to 6.0.1 or later

Source & attribution
This 0xCERT advisory summarises GHSA-pvmv-cwg8-v6c8 from the GitHub Advisory Database, credited upstream to sangsoo-osec, fivelittleducks: https://github.com/advisories/GHSA-pvmv-cwg8-v6c8. Details may change; refer to the original source for the authoritative record.

References
- ----------
- - https://github.com/advisories/GHSA-pvmv-cwg8-v6c8
- - https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-pvmv-cwg8-v6c8

Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc
Fingerprint: 5F94 3ED1 1E50 CF31 2128  C493 CCC7 D9EC 9415 723D

-----BEGIN PGP SIGNATURE-----

wrsEARYKAG0FgmrIRl8JEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp
b25zLm9wZW5wZ3Bqcy5vcmcCWGHVNf4Sog6miePgBOPbhbEcOupjFykLxZDR
CKQlxhYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAACIrwD/cYPm9SRB+tkGTF6z
3P1gAPg0ZSiNp7jiGqMwJf9xzS8A/RhGjMnWBQ+PXgIkOpu1sqCPjk0BNZ+I
D/XGwymakuoM
=TXvs
-----END PGP SIGNATURE-----