{"id":"EUVD-2026-61170","enisaUuid":"e05cb2dc-6b9d-3fa7-9fcd-fba0327941c4","description":"ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, one unauthenticated P2P peer can monopolize all 25 MAX_INBOUND_CONCURRENCY slots in Zebra\u0027s inbound mempool download and verification pipeline. In zebrad/src/components/mempool/downloads.rs, the bounded queue was shared globally without per-peer accounting, while peer identity was not carried through Gossip and FullQueue responses were mapped to Response::Nil instead of reaching overload disconnection handling. An attacker can advertise fake transaction identifiers and remain silent so each task holds a slot until TRANSACTION_DOWNLOAD_TIMEOUT, then periodically refill the queue as slots expire. While saturated, honest peer transactions and local sendrawtransaction requests are rejected with MempoolError::FullQueue, although block validation and synchronization continue. This issue is fixed in version 4.5.0.","datePublished":"Aug 18, 2026, 7:26:07 PM","dateUpdated":"Aug 18, 2026, 7:32:31 PM","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-4fc2-h7jh-287c\nhttps://github.com/ZcashFoundation/zebra/commit/1440b43ca7df59aca948090d45117557b217a6cd\nhttps://github.com/ZcashFoundation/zebra/releases/tag/v4.5.0\n","aliases":"CVE-2026-52732\nGHSA-4fc2-h7jh-287c\n","assigner":"GitHub_M","epss":0.51,"enisaIdProduct":[{"id":"9d88ba50-e4d4-3629-996d-ed50d18cb96f","product":{"name":"zebra","vendor":{"name":"ZcashFoundation"}},"product_version":"\u003c 4.5.0"}],"enisaIdVendor":[{"id":"3eb9e480-8996-3728-a6e3-3d548438688d","vendor":{"name":"ZcashFoundation"}}],"enisaIdVulnerability":[{"id":"0d3ce30b-c2e0-3b7f-b7ae-b3def11c4f2d","vulnerability":{"id":"GHSA-4fc2-h7jh-287c","description":"zebrad has mempool transaction admission denial via single-peer inbound queue saturation","datePublished":"Jul 2, 2026, 7:39:02 PM","dateUpdated":"Jul 2, 2026, 7:39:02 PM","baseScore":0.0,"references":"https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-4fc2-h7jh-287c\nhttps://github.com/ZcashFoundation/zebra\nhttps://github.com/ZcashFoundation/zebra/blob/d4cd662c716382f6397d2a730148025a1ca79fec/zebrad/src/components/mempool/downloads.rs#L82\n","enisa_id":"EUVD-2026-61170\n","aliases":"CVE-2026-52732\nGHSA-4fc2-h7jh-287c\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:02:28 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"41e2e4fe-c5be-3a33-86c2-1297a3903834","vulnerability":{"id":"CVE-2026-52732","description":"ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, one unauthenticated P2P peer can monopolize all 25 MAX_INBOUND_CONCURRENCY slots in Zebra\u0027s inbound mempool download and verification pipeline. In zebrad/src/components/mempool/downloads.rs, the bounded queue was shared globally without per-peer accounting, while peer identity was not carried through Gossip and FullQueue responses were mapped to Response::Nil instead of reaching overload disconnection handling. An attacker can advertise fake transaction identifiers and remain silent so each task holds a slot until TRANSACTION_DOWNLOAD_TIMEOUT, then periodically refill the queue as slots expire. While saturated, honest peer transactions and local sendrawtransaction requests are rejected with MempoolError::FullQueue, although block validation and synchronization continue. This issue is fixed in version 4.5.0.","datePublished":"Aug 18, 2026, 7:26:07 PM","dateUpdated":"Aug 18, 2026, 7:32:31 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-4fc2-h7jh-287c\nhttps://github.com/ZcashFoundation/zebra/commit/1440b43ca7df59aca948090d45117557b217a6cd\nhttps://github.com/ZcashFoundation/zebra/releases/tag/v4.5.0\n","enisa_id":"EUVD-2026-61170\n","assigner":"GitHub_M","epss":0.51,"dataProcessed":"Nov 3, 2026, 7:15:55 AM","vulnerabilityProduct":[{"id":"bdbcd647-1fc7-350a-9848-8366508eac65","product":{"name":"zebra","vendor":{"name":"ZcashFoundation"}},"product_version":"\u003c 4.5.0"}],"vulnerabilityVendor":[{"id":"3402a71b-ff59-36da-803d-c811d62f2744","vendor":{"name":"ZcashFoundation"}}]}}],"enisaIdAdvisory":[]}