Zcash Foundation’s Zebra node implementation contains a resource exhaustion vulnerability: while deserializing addr and addrv2 P2P messages Zebra allocates a vector capacity based on a 2 MiB message limit, allowing more than 233,000 addresses even though the protocol caps the list at 1,000. This memory is committed before the upper bound is enforced, so an attacker who sends many such messages over multiple connections can exhaust the node’s heap and trigger an out‑of‑memory abort, causing a denial of service. The flaw is a classic CWE‑770 scenario.

The problem exists in zebrad releases prior to v4.3.0 and in zebra‑network releases before v5.0.1. Any node running those legacy versions and accepting external addr/addrv2 messages is at risk. Versions v4.3.0 of zebrad and v5.0.1 of zebra‑network contain the fix.

The CVSS score of 6.3 places the vulnerability in the high severity range. The EPSS score is not available and the issue is not listed in CISA’s KEV catalog, implying that known exploitation activity is either low or not documented. Nevertheless, the flaw can be triggered remotely over untrusted network connections with no authentication, making it potentially exploitable by anyone who can reach the node. Attacking such a node would involve sending large addr/addrv2 messages on multiple connections to drain memory, and the lack of built‑in mitigation in affected releases keeps the risk significant until the patch is applied.