The vulnerability is an unbounded memory leak in the Zebra node’s mempool download pipeline. When a transaction verification process times out, the timeout handler fails to remove the corresponding cancel_handle entry, leaving a full transaction object in memory. Continued traffic causes monotonic growth until the operating system terminates the zebrad process due to exhausting available memory. This flaw is a classic denial‑of‑service issue arising from improper memory management, classified as CWE‑401.

ZcashFoundation Zebra nodes running any version older than 4.5.0 are impacted. The issue exists in the component responsible for handling incoming peer transactions and does not require privileged access or authentication to exploit.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is unavailable, so the likelihood of exploitation is uncertain. The vulnerability can be triggered by any unauthenticated P2P peer, meaning an attacker can connect to a zebra node over the network, send arbitrary transactions, then cease transmission to force the timeout path. Sustained malicious traffic can cause memory growth to the point of node termination, disrupting the service or surrounding infrastructure. The issue is not listed in the CISA KEV catalog, but its nature warrants immediate mitigation for nodes exposed to the public P2P network.