CVE-2026-52732: ZEBRA Zcash Node DOS Vulnerability

CVE-2026-52732 Overview

CVE-2026-52732 is a resource exhaustion vulnerability [CWE-770] in Zebra, a Zcash node implementation written in Rust. Versions prior to 4.5.0 allow a single unauthenticated peer-to-peer (P2P) peer to monopolize all 25 MAX_INBOUND_CONCURRENCY slots in the inbound mempool download and verification pipeline. The bounded queue in zebrad/src/components/mempool/downloads.rs was shared globally without per-peer accounting. Peer identity was not carried through Gossip, and FullQueue responses were mapped to Response::Nil rather than reaching overload disconnection handling. The Zcash Foundation fixed the issue in Zebra 4.5.0.

Critical Impact
A single unauthenticated peer can saturate Zebra's mempool download pipeline, causing rejection of honest peer transactions and local sendrawtransaction requests until the attacker stops refilling the queue.

Affected Products

Zebra Zcash node versions prior to 4.5.0
zebrad component containing the mempool/downloads.rs module
Zcash Foundation Zebra reference implementation

Discovery Timeline

2026-08-18 - CVE-2026-52732 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-52732

Vulnerability Analysis

Zebra's inbound mempool pipeline uses a bounded queue with a hard cap of 25 concurrent transaction downloads (MAX_INBOUND_CONCURRENCY). Each inbound transaction advertisement occupies one slot until the download completes or hits TRANSACTION_DOWNLOAD_TIMEOUT. The queue was shared across all peers without tracking which peer owned which slot. As a result, no single peer could be identified as monopolizing the queue, and no per-peer quota could be enforced.

A compounding defect existed in the response mapping logic. When the queue was full, the code returned Response::Nil instead of a FullQueue signal that would trigger overload disconnection. The node therefore continued to accept advertisements from the abusive peer rather than dropping the connection.

Block validation and chain synchronization continued to function during saturation. The impact was scoped to mempool availability, which aligns with the availability-only impact reflected in the CVSS vector.

Root Cause

The root cause is missing rate limiting on a shared resource [CWE-770]. Two design gaps combine to produce the vulnerability: absence of per-peer accounting in the bounded mempool download queue, and loss of peer identity through the Gossip response path so that FullQueue errors could not reach the overload disconnection handler.

Attack Vector

An attacker connects to a Zebra node over the standard P2P network. The attacker advertises fabricated transaction identifiers using inv messages and then remains silent, never delivering the referenced transactions. Each fake advertisement holds a slot until TRANSACTION_DOWNLOAD_TIMEOUT expires. By refilling slots as they free up, the attacker keeps all 25 slots occupied indefinitely. Honest peer transactions and local sendrawtransaction RPC calls are rejected with MempoolError::FullQueue.

text

// Patch reference from Cargo.lock (v4.5.0 release)
[[package]]
 name = "zebra-chain"
-version = "7.0.0"
+version = "8.0.0"
 dependencies = [
  "bech32",
  "bitflags 2.11.1",

Source: GitHub Commit 1440b43

Detection Methods for CVE-2026-52732

Indicators of Compromise

Repeated MempoolError::FullQueue errors in zebrad logs affecting local sendrawtransaction RPC calls.
A single remote peer sourcing a disproportionate share of inv messages for transaction hashes that are never delivered.
Sustained 25 in-flight mempool downloads with growing timeout counts attributed to one peer address.

Detection Strategies

Instrument zebrad metrics to alert when mempool download slots remain at capacity for durations exceeding several TRANSACTION_DOWNLOAD_TIMEOUT cycles.
Correlate P2P connection metadata with per-peer counts of advertised versus delivered transactions to surface silent advertisers.
Monitor rejection rates for local sendrawtransaction calls as a leading signal of pipeline saturation.

Monitoring Recommendations

Aggregate zebrad logs into a centralized analytics platform and build queries that group FullQueue errors by time window and peer identifier.
Track P2P peer churn and compare download completion ratios across peers to identify outliers.
Alert when the mempool download queue depth remains at MAX_INBOUND_CONCURRENCY for extended periods.

How to Mitigate CVE-2026-52732

Immediate Actions Required

Upgrade all Zebra nodes to version 4.5.0 or later, which is the vendor-supplied fix.
Restrict inbound P2P connections to trusted peers where operationally feasible until the upgrade is applied.
Review zebrad logs for historical FullQueue conditions and identify any persistent offending peers.

Patch Information

The fix is available in Zebra release v4.5.0. The remediation is documented in GHSA-4fc2-h7jh-287c and applied in commit 1440b43. The patch introduces per-peer accounting for mempool download slots and routes FullQueue responses to the overload disconnection handler so that abusive peers are dropped.

Workarounds

Operate Zebra behind a firewall that limits inbound P2P connections to a curated allowlist of known peers.
Reduce exposure by binding the P2P listener to internal interfaces when the node does not need to serve public peers.
Manually disconnect and ban peers observed sending high volumes of inv messages without follow-through transaction data.

bash

# Upgrade Zebra to the patched release
git clone https://github.com/ZcashFoundation/zebra.git
cd zebra
git checkout v4.5.0
cargo build --release
# Verify version before starting the node
./target/release/zebrad --version