CVE-2026-52734

Received Received - Intake

Memory Exhaustion in ZEBRA Node via P2P Peer

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, an unauthenticated P2P peer can cause the mempool download pipeline to retain transactions after verification reaches the outer RATE_LIMIT_DELAY timeout. In zebrad/src/components/mempool/downloads.rs, Downloads::poll_next removed cancel_handles entries after success and ordinary verification errors, but tokio::time::error::Elapsed did not carry the UnminedTxId needed to remove the timed-out entry. Each retained cancel_handles entry could hold a full Gossip::Tx(UnminedTx), while normal mined-transaction cleanup could not match attacker transactions and no periodic garbage collection or count cap existed. Sustained traffic therefore caused monotonic memory growth until swap pressure degraded the node or the operating system terminated the zebrad process for exhausting memory. This issue is fixed in version 4.5.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-18

Generated

2026-08-19

AI Q&A

2026-08-19

EPSS Evaluated

N/A

NVD

CVE-2026-52734

EUVD

EUVD-2026-61164

Affected Vendors & Products

Vendor	Product	Version / Range
zebra	zebrad	4.5.0
zcashfoundation	zebra	4.5.0
zcashfoundation	zebra	to 4.4.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-401	The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

Executive Summary

This vulnerability is an unbounded memory leak in Zebra, a Zcash node written in Rust. It occurs when an unauthenticated peer connects via P2P and causes the mempool to retain transactions after verification times out. The system fails to remove transaction entries from the cancel_handles map due to missing transaction ID data in timeout errors, leading to memory growth until the node crashes.

Detection Guidance

Monitor memory usage of the zebrad process over time. Use system tools like 'top', 'htop', or 'ps' to track memory consumption. Check for sustained increases in memory usage, particularly after accepting inbound P2P connections. If memory grows without bound, it may indicate this vulnerability.

Impact Analysis

The impact includes memory exhaustion on the affected node, leading to performance degradation or process termination. Sustained attacker traffic could cause the node to consume excessive memory over hours, requiring a restart to clear the accumulated entries. No direct fund loss or data corruption occurs.

Mitigation Strategies

Upgrade to Zebra version 4.5.0 or later to patch the vulnerability. If immediate upgrade is not possible, restart the zebrad process to clear accumulated entries. Avoid accepting inbound P2P connections until patched.

Hi! I’m here to help you understand CVE-2026-52734. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70