Description
ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, one unauthenticated P2P peer can monopolize all 25 MAX_INBOUND_CONCURRENCY slots in Zebra's inbound mempool download and verification pipeline. In zebrad/src/components/mempool/downloads.rs, the bounded queue was shared globally without per-peer accounting, while peer identity was not carried through Gossip and FullQueue responses were mapped to Response::Nil instead of reaching overload disconnection handling. An attacker can advertise fake transaction identifiers and remain silent so each task holds a slot until TRANSACTION_DOWNLOAD_TIMEOUT, then periodically refill the queue as slots expire. While saturated, honest peer transactions and local sendrawtransaction requests are rejected with MempoolError::FullQueue, although block validation and synchronization continue. This issue is fixed in version 4.5.0.
Published: 2026-08-18
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Zebra is a fully Rust‑implemented Zcash node. Prior to version 4.5.0, a single unauthenticated peer can monopolise all 25 inbound concurrency slots in the mempool download queue because the queue was globally shared without per‑peer accounting. The attacker advertises fake transaction IDs, keeps the slots busy until the download timeout, then refills them, keeping the queue saturated. While saturated, honest peer transactions and local sendrawtransaction requests are dropped with MempoolError::FullQueue, disrupting legitimate traffic.

Affected Systems

The affected systems are Zebra nodes produced by ZcashFoundation. Any release before v4.5.0 is vulnerable, as the bug resides in the mempool download component that was fixed in that release.

Risk and Exploitability

The CVSS base score is 5.3, indicating moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, implying no reported exploits to date. An attacker only needs to establish an unauthenticated P2P connection to the node, which is common for Zebra nodes. By saturating the inbound queue, the node cannot admit new transactions, effectively denying service to clients while still completing block validation and network synchronization.

Generated by OpenCVE AI on August 18, 2026 at 20:32 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Zebra to version 4.5.0 or later, which addresses the global queue sharing flaw.
  • If an upgrade cannot be applied immediately, configure the node or network firewall to accept inbound connections only from trusted peers, limiting the attacker’s ability to monopolise the queue.
  • Monitor the node for repeated FullQueue errors or a high number of pending transactions and consider temporarily reducing the allowed inbound peer count until a patch is deployed.
  • In general, enforce per‑peer resource accounting and ensure that queue overload conditions trigger disconnection logic, following the remediation guidance for CWE‑770.

Generated by OpenCVE AI on August 18, 2026 at 20:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-4fc2-h7jh-287c zebrad has mempool transaction admission denial via single-peer inbound queue saturation
History

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
First Time appeared Zcashfoundation
Zcashfoundation zebra
Vendors & Products Zcashfoundation
Zcashfoundation zebra

Tue, 18 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 18 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Description ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, one unauthenticated P2P peer can monopolize all 25 MAX_INBOUND_CONCURRENCY slots in Zebra's inbound mempool download and verification pipeline. In zebrad/src/components/mempool/downloads.rs, the bounded queue was shared globally without per-peer accounting, while peer identity was not carried through Gossip and FullQueue responses were mapped to Response::Nil instead of reaching overload disconnection handling. An attacker can advertise fake transaction identifiers and remain silent so each task holds a slot until TRANSACTION_DOWNLOAD_TIMEOUT, then periodically refill the queue as slots expire. While saturated, honest peer transactions and local sendrawtransaction requests are rejected with MempoolError::FullQueue, although block validation and synchronization continue. This issue is fixed in version 4.5.0.
Title ZEBRA: Mempool transaction admission denial via single-peer inbound queue saturation
Weaknesses CWE-770
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}

Subscriptions

Zcashfoundation Zebra
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-18T19:32:31.103Z

Reserved: 2026-06-08T14:00:43.572Z

Link: CVE-2026-52732

cve-icon Vulnrichment

Updated: 2026-08-18T19:32:27.989Z

cve-icon NVD

Status : Received

Published: 2026-08-18T20:17:16.710

Modified: 2026-08-18T20:17:16.710

Link: CVE-2026-52732

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-18T21:00:04Z

Weaknesses
  • CWE-770

    Allocation of Resources Without Limits or Throttling