Vulnerability-Lookup

CVE-2026-52732 (GCVE-0-2026-52732)

Vulnerability from cvelistv5 – Published: 2026-08-18 19:26 – Updated: 2026-08-18 19:32

Title

ZEBRA: Mempool transaction admission denial via single-peer inbound queue saturation

Summary

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, one unauthenticated P2P peer can monopolize all 25 MAX_INBOUND_CONCURRENCY slots in Zebra's inbound mempool download and verification pipeline. In zebrad/src/components/mempool/downloads.rs, the bounded queue was shared globally without per-peer accounting, while peer identity was not carried through Gossip and FullQueue responses were mapped to Response::Nil instead of reaching overload disconnection handling. An attacker can advertise fake transaction identifiers and remain silent so each task holds a slot until TRANSACTION_DOWNLOAD_TIMEOUT, then periodically refill the queue as slots expire. While saturated, honest peer transactions and local sendrawtransaction requests are rejected with MempoolError::FullQueue, although block validation and synchronization continue. This issue is fixed in version 4.5.0.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-18 19:32 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7674 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/ZcashFoundation/zebra/security…	x_refsource_CONFIRM
https://github.com/ZcashFoundation/zebra/commit/1…	x_refsource_MISC
https://github.com/ZcashFoundation/zebra/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
ZcashFoundation	zebra	Affected: < 4.5.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-52732",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-18T19:32:12.651849Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-18T19:32:31.103Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-4fc2-h7jh-287c"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "zebra",
          "vendor": "ZcashFoundation",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, one unauthenticated P2P peer can monopolize all 25 MAX_INBOUND_CONCURRENCY slots in Zebra\u0027s inbound mempool download and verification pipeline. In zebrad/src/components/mempool/downloads.rs, the bounded queue was shared globally without per-peer accounting, while peer identity was not carried through Gossip and FullQueue responses were mapped to Response::Nil instead of reaching overload disconnection handling. An attacker can advertise fake transaction identifiers and remain silent so each task holds a slot until TRANSACTION_DOWNLOAD_TIMEOUT, then periodically refill the queue as slots expire. While saturated, honest peer transactions and local sendrawtransaction requests are rejected with MempoolError::FullQueue, although block validation and synchronization continue. This issue is fixed in version 4.5.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-18T19:26:07.345Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-4fc2-h7jh-287c",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-4fc2-h7jh-287c"
        },
        {
          "name": "https://github.com/ZcashFoundation/zebra/commit/1440b43ca7df59aca948090d45117557b217a6cd",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ZcashFoundation/zebra/commit/1440b43ca7df59aca948090d45117557b217a6cd"
        },
        {
          "name": "https://github.com/ZcashFoundation/zebra/releases/tag/v4.5.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ZcashFoundation/zebra/releases/tag/v4.5.0"
        }
      ],
      "source": {
        "advisory": "GHSA-4fc2-h7jh-287c",
        "discovery": "UNKNOWN"
      },
      "title": "ZEBRA: Mempool transaction admission denial via single-peer inbound queue saturation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-52732",
    "datePublished": "2026-08-18T19:26:07.345Z",
    "dateReserved": "2026-06-08T14:00:43.572Z",
    "dateUpdated": "2026-08-18T19:32:31.103Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-52732",
      "date": "2026-10-22",
      "epss": "0.00507",
      "percentile": "0.42343"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "zebra",
                "vendor": "ZcashFoundation",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 4.5.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, one unauthenticated P2P peer can monopolize all 25 MAX_INBOUND_CONCURRENCY slots in Zebra\u0027s inbound mempool download and verification pipeline. In zebrad/src/components/mempool/downloads.rs, the bounded queue was shared globally without per-peer accounting, while peer identity was not carried through Gossip and FullQueue responses were mapped to Response::Nil instead of reaching overload disconnection handling. An attacker can advertise fake transaction identifiers and remain silent so each task holds a slot until TRANSACTION_DOWNLOAD_TIMEOUT, then periodically refill the queue as slots expire. While saturated, honest peer transactions and local sendrawtransaction requests are rejected with MempoolError::FullQueue, although block validation and synchronization continue. This issue is fixed in version 4.5.0."
          },
          {
            "lang": "es",
            "value": "ZEBRA es un nodo Zcash escrito completamente en Rust. Antes de la versi\u00f3n 4.5.0, un par P2P no autenticado puede monopolizar las 25 ranuras MAX_INBOUND_CONCURRENCY en la tuber\u00eda de descarga y verificaci\u00f3n de la mempool entrante de Zebra. En zebrad/src/components/mempool/downloads.rs, la cola limitada se compart\u00eda globalmente sin contabilidad por par, mientras que la identidad del par no se transmit\u00eda a trav\u00e9s de Gossip y las respuestas FullQueue se mapeaban a Response::Nil en lugar de alcanzar el manejo de desconexi\u00f3n por sobrecarga. Un atacante puede anunciar identificadores de transacci\u00f3n falsos y permanecer en silencio para que cada tarea retenga una ranura hasta TRANSACTION_DOWNLOAD_TIMEOUT, luego rellenar peri\u00f3dicamente la cola a medida que las ranuras expiran. Mientras est\u00e1 saturado, las transacciones de pares honestos y las solicitudes locales de sendrawtransaction son rechazadas con MempoolError::FullQueue, aunque la validaci\u00f3n y sincronizaci\u00f3n de bloques contin\u00faan. Este problema est\u00e1 solucionado en la versi\u00f3n 4.5.0."
          }
        ],
        "id": "CVE-2026-52732",
        "lastModified": "2026-10-22T22:10:00.250",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 1.4,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-52732",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-18T19:32:12.651849Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-08-18T20:17:16.710",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/ZcashFoundation/zebra/commit/1440b43ca7df59aca948090d45117557b217a6cd"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/ZcashFoundation/zebra/releases/tag/v4.5.0"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-4fc2-h7jh-287c"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-4fc2-h7jh-287c"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-770"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Primary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-52732",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-18T19:32:12.651849Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-18T19:32:27.989Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-4fc2-h7jh-287c"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "zebra",
              "vendor": "ZcashFoundation",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 4.5.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, one unauthenticated P2P peer can monopolize all 25 MAX_INBOUND_CONCURRENCY slots in Zebra\u0027s inbound mempool download and verification pipeline. In zebrad/src/components/mempool/downloads.rs, the bounded queue was shared globally without per-peer accounting, while peer identity was not carried through Gossip and FullQueue responses were mapped to Response::Nil instead of reaching overload disconnection handling. An attacker can advertise fake transaction identifiers and remain silent so each task holds a slot until TRANSACTION_DOWNLOAD_TIMEOUT, then periodically refill the queue as slots expire. While saturated, honest peer transactions and local sendrawtransaction requests are rejected with MempoolError::FullQueue, although block validation and synchronization continue. This issue is fixed in version 4.5.0."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-770",
                  "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-18T19:26:07.345Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-4fc2-h7jh-287c",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-4fc2-h7jh-287c"
            },
            {
              "name": "https://github.com/ZcashFoundation/zebra/commit/1440b43ca7df59aca948090d45117557b217a6cd",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/ZcashFoundation/zebra/commit/1440b43ca7df59aca948090d45117557b217a6cd"
            },
            {
              "name": "https://github.com/ZcashFoundation/zebra/releases/tag/v4.5.0",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/ZcashFoundation/zebra/releases/tag/v4.5.0"
            }
          ],
          "source": {
            "advisory": "GHSA-4fc2-h7jh-287c",
            "discovery": "UNKNOWN"
          },
          "title": "ZEBRA: Mempool transaction admission denial via single-peer inbound queue saturation"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-52732",
        "datePublished": "2026-08-18T19:26:07.345Z",
        "dateReserved": "2026-06-08T14:00:43.572Z",
        "dateUpdated": "2026-08-18T19:32:31.103Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-52732

Vulnerability from fkie_nvd - Published: 2026-08-18 20:17 - Updated: 2026-10-22 22:10

Severity

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/ZcashFoundation/zebra/commit/1440b43ca7df59aca948090d45117557b217a6cd
	security-advisories@github.com	https://github.com/ZcashFoundation/zebra/releases/tag/v4.5.0
	security-advisories@github.com	https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-4fc2-h7jh-287c
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-4fc2-h7jh-287c

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "zebra",
          "vendor": "ZcashFoundation",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.5.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, one unauthenticated P2P peer can monopolize all 25 MAX_INBOUND_CONCURRENCY slots in Zebra\u0027s inbound mempool download and verification pipeline. In zebrad/src/components/mempool/downloads.rs, the bounded queue was shared globally without per-peer accounting, while peer identity was not carried through Gossip and FullQueue responses were mapped to Response::Nil instead of reaching overload disconnection handling. An attacker can advertise fake transaction identifiers and remain silent so each task holds a slot until TRANSACTION_DOWNLOAD_TIMEOUT, then periodically refill the queue as slots expire. While saturated, honest peer transactions and local sendrawtransaction requests are rejected with MempoolError::FullQueue, although block validation and synchronization continue. This issue is fixed in version 4.5.0."
    },
    {
      "lang": "es",
      "value": "ZEBRA es un nodo Zcash escrito completamente en Rust. Antes de la versi\u00f3n 4.5.0, un par P2P no autenticado puede monopolizar las 25 ranuras MAX_INBOUND_CONCURRENCY en la tuber\u00eda de descarga y verificaci\u00f3n de la mempool entrante de Zebra. En zebrad/src/components/mempool/downloads.rs, la cola limitada se compart\u00eda globalmente sin contabilidad por par, mientras que la identidad del par no se transmit\u00eda a trav\u00e9s de Gossip y las respuestas FullQueue se mapeaban a Response::Nil en lugar de alcanzar el manejo de desconexi\u00f3n por sobrecarga. Un atacante puede anunciar identificadores de transacci\u00f3n falsos y permanecer en silencio para que cada tarea retenga una ranura hasta TRANSACTION_DOWNLOAD_TIMEOUT, luego rellenar peri\u00f3dicamente la cola a medida que las ranuras expiran. Mientras est\u00e1 saturado, las transacciones de pares honestos y las solicitudes locales de sendrawtransaction son rechazadas con MempoolError::FullQueue, aunque la validaci\u00f3n y sincronizaci\u00f3n de bloques contin\u00faan. Este problema est\u00e1 solucionado en la versi\u00f3n 4.5.0."
    }
  ],
  "id": "CVE-2026-52732",
  "lastModified": "2026-10-22T22:10:00.250",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-52732",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-18T19:32:12.651849Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-18T20:17:16.710",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/ZcashFoundation/zebra/commit/1440b43ca7df59aca948090d45117557b217a6cd"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/ZcashFoundation/zebra/releases/tag/v4.5.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-4fc2-h7jh-287c"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-4fc2-h7jh-287c"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-4FC2-H7JH-287C

Vulnerability from github – Published: 2026-07-02 19:39 – Updated: 2026-07-02 19:39

Summary

zebrad has mempool transaction admission denial via single-peer inbound queue saturation

Details

Am I affected

You are affected if:

You run zebrad up to and including v4.4.1.
Your node accepts inbound P2P connections (network.listen_addr is set, which is the default).
Your node's mempool is active (node is synced near the chain tip).

All default configurations are affected.

Summary

A single unauthenticated P2P peer can monopolize all 25 inbound mempool download/verification slots (MAX_INBOUND_CONCURRENCY) by advertising fake transaction IDs. While the slots are occupied, all other inbound transactions from honest peers and local RPC sendrawtransaction calls are rejected with MempoolError::FullQueue. The attacker peer is never scored for misbehavior and is not disconnected, allowing sustained denial of mempool admission.

Details

The mempool download/verification pipeline at zebrad/src/components/mempool/downloads.rs uses a single bounded pool of 25 concurrent tasks. Three architectural gaps combine to produce the vulnerability:

No per-peer accounting: the 25 slots are shared across all peers with no cap on how many a single peer can hold.
No overload signaling: when FullQueue is returned, the inbound service at zebrad/src/components/inbound.rs maps it to Response::Nil, hiding the overload from the peer connection layer. The existing handle_inbound_overload disconnection logic never fires.
No misbehavior attribution: peer identity is not carried through the Gossip type into the download pipeline, so verification failures cannot be attributed to the originating peer.

The attacker sends inv messages advertising fake transaction IDs. Zebra queues download tasks for each ID. The attacker stays silent; each slot is held until the TRANSACTION_DOWNLOAD_TIMEOUT (20 seconds) fires. The attacker periodically sends fresh inv waves to re-fill slots as they expire.

Two additional slot-holding techniques have been independently demonstrated: invalid-prevout transactions that park in AwaitOutput for 60 seconds, and expensive shielded proof verification with auth-variant cache bypass. All three techniques are addressed by the same per-peer accounting fix.

Patches

zebrad 4.5.0

The fix adds per-peer queue accounting to the mempool download pipeline. A single peer is limited to a fraction of MAX_INBOUND_CONCURRENCY (e.g., 5 slots out of 25). FullQueue is surfaced as an overload signal to the peer connection layer. Peer identity is plumbed through the Gossip type for misbehavior attribution.

Workarounds

There is no complete configuration-level workaround. Reducing network.peerset_initial_target_size limits the total inbound peer count but does not prevent a single peer from holding all mempool slots.

Impact

Mempool transaction admission is denied for all honest peers and local RPC clients while the attack is sustained. Block validation and chain synchronization continue normally. The attacker needs only one TCP connection and minimal bandwidth (~1 KB/s of fake inv messages). The node recovers immediately when the attacker stops. This does not affect consensus, funds, or on-disk state.

Credit

Reported by @dingledropper via a private GitHub Security Advisory submission.

Severity

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.4.1"
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "zebrad"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.5.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-52732"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-770"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-02T19:39:02Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Am I affected\n\nYou are affected if:\n\n1. You run `zebrad` up to and including `v4.4.1`.\n2. Your node accepts inbound P2P connections (`network.listen_addr` is set, which is the default).\n3. Your node\u0027s mempool is active (node is synced near the chain tip).\n\nAll default configurations are affected.\n\n### Summary\n\nA single unauthenticated P2P peer can monopolize all 25 inbound mempool download/verification slots (`MAX_INBOUND_CONCURRENCY`) by advertising fake transaction IDs. While the slots are occupied, all other inbound transactions from honest peers and local RPC `sendrawtransaction` calls are rejected with `MempoolError::FullQueue`. The attacker peer is never scored for misbehavior and is not disconnected, allowing sustained denial of mempool admission.\n\n### Details\n\nThe mempool download/verification pipeline at `zebrad/src/components/mempool/downloads.rs` uses a single bounded pool of 25 concurrent tasks. Three architectural gaps combine to produce the vulnerability:\n\n1. No per-peer accounting: the 25 slots are shared across all peers with no cap on how many a single peer can hold.\n2. No overload signaling: when `FullQueue` is returned, the inbound service at `zebrad/src/components/inbound.rs` maps it to `Response::Nil`, hiding the overload from the peer connection layer. The existing `handle_inbound_overload` disconnection logic never fires.\n3. No misbehavior attribution: peer identity is not carried through the `Gossip` type into the download pipeline, so verification failures cannot be attributed to the originating peer.\n\nThe attacker sends `inv` messages advertising fake transaction IDs. Zebra queues download tasks for each ID. The attacker stays silent; each slot is held until the `TRANSACTION_DOWNLOAD_TIMEOUT` (20 seconds) fires. The attacker periodically sends fresh `inv` waves to re-fill slots as they expire.\n\nTwo additional slot-holding techniques have been independently demonstrated: invalid-prevout transactions that park in `AwaitOutput` for 60 seconds, and expensive shielded proof verification with auth-variant cache bypass. All three techniques are addressed by the same per-peer accounting fix.\n\n### Patches\n\nzebrad 4.5.0\n\nThe fix adds per-peer queue accounting to the mempool download pipeline. A single peer is limited to a fraction of `MAX_INBOUND_CONCURRENCY` (e.g., 5 slots out of 25). `FullQueue` is surfaced as an overload signal to the peer connection layer. Peer identity is plumbed through the `Gossip` type for misbehavior attribution.\n\n### Workarounds\n\nThere is no complete configuration-level workaround. Reducing `network.peerset_initial_target_size` limits the total inbound peer count but does not prevent a single peer from holding all mempool slots.\n\n### Impact\n\nMempool transaction admission is denied for all honest peers and local RPC clients while the attack is sustained. Block validation and chain synchronization continue normally. The attacker needs only one TCP connection and minimal bandwidth (~1 KB/s of fake `inv` messages). The node recovers immediately when the attacker stops. This does not affect consensus, funds, or on-disk state.\n\n### Credit\n\nReported by `@dingledropper` via a private GitHub Security Advisory submission.",
  "id": "GHSA-4fc2-h7jh-287c",
  "modified": "2026-07-02T19:39:02Z",
  "published": "2026-07-02T19:39:02Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-4fc2-h7jh-287c"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ZcashFoundation/zebra"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ZcashFoundation/zebra/blob/d4cd662c716382f6397d2a730148025a1ca79fec/zebrad/src/components/mempool/downloads.rs#L82"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "zebrad has mempool transaction admission denial via single-peer inbound queue saturation"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-52732 (GCVE-0-2026-52732)

FKIE_CVE-2026-52732

GHSA-4FC2-H7JH-287C

Am I affected

Summary

Details

Patches

Workarounds

Impact

Credit

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour