The vulnerability manifests when inbound network deserialization in Zebra preallocates buffers based on generic transport ceilings before enforcing stricter protocol limits. An unauthenticated or post-handshake peer can force the node to allocate and parse data far exceeding intended limits across various message types, consuming excessive memory and potentially causing denial of service.

Affected systems are the Zcash Foundation's Zebra node implementations. Prior to version 4.4.0 of the zebrad component, prior to 7.0.0 of zebra-chain, and prior to 6.0.0 of zebra-network, these allocation issues were present. The fix is available in those three component releases.

The CVSS score of 5.3 indicates moderate severity. No EPSS data is available and the vulnerability is not listed in CISA's KEV catalog, suggesting a lower exploitation likelihood. However, the attack can be carried out remotely over an inbound network connection from an unauthenticated or post-handshake peer, making it feasible for adversaries to trigger the allocation amplification and exhaust memory, leading to service disruption.