CVE-2026-52734: ZEBRA Zcash Node DOS Vulnerability

CVE-2026-52734 Overview

CVE-2026-52734 is a memory leak vulnerability [CWE-401] in Zebra, a Zcash node implementation written in Rust. Versions prior to 4.5.0 fail to remove cancel_handles entries when transaction verification times out at the outer RATE_LIMIT_DELAY boundary. An unauthenticated peer-to-peer peer can trigger this condition remotely, causing the mempool download pipeline to retain full Gossip::Tx(UnminedTx) objects indefinitely. Sustained traffic produces monotonic memory growth until the operating system terminates zebrad for exhausting memory.

Critical Impact
Unauthenticated remote attackers can exhaust node memory through crafted P2P transaction traffic, causing denial of service on Zcash network participants running affected Zebra versions.

Affected Products

Zebra Zcash node versions prior to 4.5.0
zebrad daemon component
zebra-chain crate versions prior to 8.0.0

Discovery Timeline

2026-08-18 - CVE-2026-52734 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-52734

Vulnerability Analysis

The vulnerability resides in zebrad/src/components/mempool/downloads.rs, specifically in the Downloads::poll_next function. The function correctly removes cancel_handles entries after successful verification and after ordinary verification errors. However, when the outer RATE_LIMIT_DELAY timeout fires, the resulting tokio::time::error::Elapsed error does not carry the UnminedTxId needed to identify and remove the corresponding entry.

Each retained cancel_handles entry holds a full Gossip::Tx(UnminedTx) payload in memory. The normal mined-transaction cleanup path cannot match transactions submitted by an attacker, because those transactions never enter a mined block. No periodic garbage collection or count cap exists to bound the map size.

Root Cause

The root cause is missing cleanup logic for a specific error variant. The Elapsed error type from tokio::time lacks the transaction identifier required by the removal routine. This asymmetry between success and timeout paths creates an unbounded resource retention condition classified under [CWE-401] Missing Release of Memory after Effective Lifetime.

Attack Vector

A remote attacker connects as an unauthenticated P2P peer and streams transactions designed to trigger verification timeouts. Each timeout leaves an entry in cancel_handles that is never reclaimed. Sustained traffic causes memory usage to grow linearly with the number of timed-out downloads until swap pressure degrades the node or the kernel terminates zebrad.

text

 [[package]]
 name = "zebra-chain"
-version = "7.0.0"
+version = "8.0.0"
 dependencies = [
  "bech32",
  "bitflags 2.11.1",

Source: GitHub Commit 1440b43

Detection Methods for CVE-2026-52734

Indicators of Compromise

Monotonic resident memory growth in the zebrad process without corresponding block or mempool activity
Repeated verification timeout log entries referencing RATE_LIMIT_DELAY or tokio::time::error::Elapsed
Out-of-memory kernel messages (oom-killer) terminating zebrad
Elevated inbound P2P transaction gossip volume from a small number of peers

Detection Strategies

Monitor zebrad resident set size (RSS) over time and alert on sustained growth trends that exceed baseline mempool churn
Correlate P2P peer connection metrics with per-peer transaction submission rates to identify abusive sources
Parse Zebra logs for high frequencies of transaction download timeouts, which indicate the leak-triggering path is being exercised

Monitoring Recommendations

Deploy process-level memory monitoring with alerting thresholds tuned below system OOM limits
Ingest zebrad logs into a centralized log platform and build queries for Elapsed verification errors
Track P2P peer reputation and disconnect counts alongside transaction verification failure rates

How to Mitigate CVE-2026-52734

Immediate Actions Required

Upgrade zebrad to version 4.5.0 or later, which contains the fix that removes cancel_handles entries on timeout
Restart any long-running zebrad instances after upgrade to clear accumulated state from vulnerable versions
Review firewall and P2P peer allowlists to limit exposure of node listeners to untrusted networks where operationally feasible

Patch Information

The fix is included in Zebra v4.5.0. See the GitHub Security Advisory GHSA-65jj-fmw8-468q, the v4.5.0 Release Notes, and the remediation commit 1440b43 for details.

Workarounds

Configure a process supervisor (for example, systemd with MemoryMax=) to restart zebrad before host memory is exhausted
Restrict inbound P2P connections to trusted peers using host firewall rules until the upgrade is applied
Reduce the maximum number of inbound peers in Zebra configuration to slow the rate of memory accumulation

bash

# Verify installed Zebra version and upgrade
zebrad --version
# Fetch and build the fixed release
git clone https://github.com/ZcashFoundation/zebra.git
cd zebra
git checkout v4.5.0
cargo build --release