{"id":"GHSA-4fc2-h7jh-287c","revision":null,"records":[{"revision":"146673b6aac947b78bdfab0656fab0c7","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-52732","aliases":[],"title":"ZEBRA: Mempool transaction admission denial via single-peer inbound queue saturation","description":"ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, one unauthenticated P2P peer can monopolize all 25 MAX_INBOUND_CONCURRENCY slots in Zebra's inbound mempool download and verification pipeline. In zebrad/src/components/mempool/downloads.rs, the bounded queue was shared globally without per-peer accounting, while peer identity was not carried through Gossip and FullQueue responses were mapped to Response::Nil instead of reaching overload disconnection handling. An attacker can advertise fake transaction identifiers and remain silent so each task holds a slot until TRANSACTION_DOWNLOAD_TIMEOUT, then periodically refill the queue as slots expire. While saturated, honest peer transactions and local sendrawtransaction requests are rejected with MempoolError::FullQueue, although block validation and synchronization continue. This issue is fixed in version 4.5.0.","state":0,"publishedAt":"2026-08-18T19:26:07.345+00:00","modifiedAt":"2026-08-18T19:32:31.103+00:00","affected":[{"ecosystem":"Vendor product","name":"zebra","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"ZcashFoundation\",\n                    \"product\": \"zebra\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 4.5.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3,"severity":"MEDIUM"}],"references":["https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-4fc2-h7jh-287c","https://github.com/ZcashFoundation/zebra/commit/1440b43ca7df59aca948090d45117557b217a6cd","https://github.com/ZcashFoundation/zebra/releases/tag/v4.5.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-52732","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-52732","identifiers":["CVE-2026-52732"]},"retained":false,"historicalAffected":[]},{"revision":"0029be4ab32047d2bf66662bf5bcbd42","observedAt":"2026-11-07T11:35:33.958+00:00","statement":{"source":"euvd","id":"EUVD-2026-61170","aliases":["CVE-2026-52732","GHSA-4fc2-h7jh-287c"],"title":"ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, one unauthenticated P2P peer can monopolize all 25 MAX_INBOUND_CONCURRENCY slots in Zebra's inbound mempool download and verification pipeline. In zebrad/src/components/mempool…","description":"ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, one unauthenticated P2P peer can monopolize all 25 MAX_INBOUND_CONCURRENCY slots in Zebra's inbound mempool download and verification pipeline. In zebrad/src/components/mempool/downloads.rs, the bounded queue was shared globally without per-peer accounting, while peer identity was not carried through Gossip and FullQueue responses were mapped to Response::Nil instead of reaching overload disconnection handling. An attacker can advertise fake transaction identifiers and remain silent so each task holds a slot until TRANSACTION_DOWNLOAD_TIMEOUT, then periodically refill the queue as slots expire. While saturated, honest peer transactions and local sendrawtransaction requests are rejected with MempoolError::FullQueue, although block validation and synchronization continue. This issue is fixed in version 4.5.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3,"severity":null}],"references":["https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-4fc2-h7jh-287c","https://github.com/ZcashFoundation/zebra/commit/1440b43ca7df59aca948090d45117557b217a6cd","https://github.com/ZcashFoundation/zebra/releases/tag/v4.5.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-61170","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 18, 2026, 7:26:07 PM","dateUpdated":"Aug 18, 2026, 7:32:31 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-61170","identifiers":["EUVD-2026-61170","CVE-2026-52732","GHSA-4fc2-h7jh-287c"]},"retained":false,"historicalAffected":[]},{"revision":"5f4ad93a106946ebafb4e0950d475cb9","observedAt":"2026-10-25T13:17:10.707+00:00","statement":{"source":"nvd","id":"CVE-2026-52732","aliases":[],"title":"ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, one unauthenticated P2P peer can monopolize all 25 MAX_INBOUND_CONCURRENCY slots in Zebra's inbound mempool download and verification pipeline. In zebrad/src/components/mempool…","description":"ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, one unauthenticated P2P peer can monopolize all 25 MAX_INBOUND_CONCURRENCY slots in Zebra's inbound mempool download and verification pipeline. In zebrad/src/components/mempool/downloads.rs, the bounded queue was shared globally without per-peer accounting, while peer identity was not carried through Gossip and FullQueue responses were mapped to Response::Nil instead of reaching overload disconnection handling. An attacker can advertise fake transaction identifiers and remain silent so each task holds a slot until TRANSACTION_DOWNLOAD_TIMEOUT, then periodically refill the queue as slots expire. While saturated, honest peer transactions and local sendrawtransaction requests are rejected with MempoolError::FullQueue, although block validation and synchronization continue. This issue is fixed in version 4.5.0.","state":0,"publishedAt":"2026-08-18T20:17:16.71+00:00","modifiedAt":"2026-10-22T22:10:00.25+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3,"severity":"MEDIUM"}],"references":["https://github.com/ZcashFoundation/zebra/commit/1440b43ca7df59aca948090d45117557b217a6cd","https://github.com/ZcashFoundation/zebra/releases/tag/v4.5.0","https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-4fc2-h7jh-287c"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-52732","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-770"],"productCriteria":[],"sourceDates":{"published":"2026-08-18T20:17:16.710","lastModified":"2026-10-22T22:10:00.250"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-52732","identifiers":["CVE-2026-52732"]},"retained":false,"historicalAffected":[]},{"revision":"0400006d565948bdb5b6e707ce1af204","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"GHSA-4fc2-h7jh-287c","aliases":["CVE-2026-52732"],"title":"zebrad has mempool transaction admission denial via single-peer inbound queue saturation","description":"### Am I affected\n\nYou are affected if:\n\n1. You run `zebrad` up to and including `v4.4.1`.\n2. Your node accepts inbound P2P connections (`network.listen_addr` is set, which is the default).\n3. Your node's mempool is active (node is synced near the chain tip).\n\nAll default configurations are affected.\n\n### Summary\n\nA single unauthenticated P2P peer can monopolize all 25 inbound mempool download/verification slots (`MAX_INBOUND_CONCURRENCY`) by advertising fake transaction IDs. While the slots are occupied, all other inbound transactions from honest peers and local RPC `sendrawtransaction` calls are rejected with `MempoolError::FullQueue`. The attacker peer is never scored for misbehavior and is not disconnected, allowing sustained denial of mempool admission.\n\n### Details\n\nThe mempool download/verification pipeline at `zebrad/src/components/mempool/downloads.rs` uses a single bounded pool of 25 concurrent tasks. Three architectural gaps combine to produce the vulnerability:\n\n1. No per-peer accounting: the 25 slots are shared across all peers with no cap on how many a single peer can hold.\n2. No overload signaling: when `FullQueue` is returned, the inbound service at `zebrad/src/components/inbound.rs` maps it to `Response::Nil`, hiding the overload from the peer connection layer. The existing `handle_inbound_overload` disconnection logic never fires.\n3. No misbehavior attribution: peer identity is not carried through the `Gossip` type into the download pipeline, so verification failures cannot be attributed to the originating peer.\n\nThe attacker sends `inv` messages advertising fake transaction IDs. Zebra queues download tasks for each ID. The attacker stays silent; each slot is held until the `TRANSACTION_DOWNLOAD_TIMEOUT` (20 seconds) fires. The attacker periodically sends fresh `inv` waves to re-fill slots as they expire.\n\nTwo additional slot-holding techniques have been independently demonstrated: invalid-prevout transactions that park in `AwaitOutput` for 60 seconds, and expensive shielded proof verification with auth-variant cache bypass. All three techniques are addressed by the same per-peer accounting fix.\n\n### Patches\n\nzebrad 4.5.0\n\nThe fix adds per-peer queue accounting to the mempool download pipeline. A single peer is limited to a fraction of `MAX_INBOUND_CONCURRENCY` (e.g., 5 slots out of 25). `FullQueue` is surfaced as an overload signal to the peer connection layer. Peer identity is plumbed through the `Gossip` type for misbehavior attribution.\n\n### Workarounds\n\nThere is no complete configuration-level workaround. Reducing `network.peerset_initial_target_size` limits the total inbound peer count but does not prevent a single peer from holding all mempool slots.\n\n### Impact\n\nMempool transaction admission is denied for all honest peers and local RPC clients while the attack is sustained. Block validation and chain synchronization continue normally. The attacker needs only one TCP connection and minimal bandwidth (~1 KB/s of fake `inv` messages). The node recovers immediately when the attacker stops. This does not affect consensus, funds, or on-disk state.\n\n### Credit\n\nReported by `@dingledropper` via a private GitHub Security Advisory submission.","state":0,"publishedAt":"2026-07-02T19:39:02+00:00","modifiedAt":"2026-07-02T19:56:31.667704+00:00","affected":[{"ecosystem":"crates.io","name":"zebrad","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"4.5.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-4fc2-h7jh-287c","https://github.com/ZcashFoundation/zebra","https://github.com/ZcashFoundation/zebra/blob/d4cd662c716382f6397d2a730148025a1ca79fec/zebrad/src/components/mempool/downloads.rs#L82"],"sourceUrl":"https://github.com/advisories/GHSA-4fc2-h7jh-287c","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-4fc2-h7jh-287c","identifiers":["GHSA-4fc2-h7jh-287c","CVE-2026-52732"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-08T07:06:42.2208240+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-08T07:06:42.220824+00:00","lastSuccessAt":"2026-11-08T07:06:42.3839308+00:00","error":null,"lastVerifiedAt":"2026-11-08T07:06:42.3839321+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-eaa64dac63caa79c8d4905619258c41c51b39e461b996124e1a21b5e85e7e738-1167b7290e843ce2b7ccffc299ffe73e10a65833db7c7e05840c0f2de122f77a","complete":true,"records":421096,"lastAttemptAt":"2026-11-08T07:06:41.7244391+00:00","lastSuccessAt":"2026-11-08T07:06:41.6928813+00:00","error":null,"lastVerifiedAt":"2026-11-08T07:06:41.7244391+00:00","snapshotPublishedAt":"2026-11-08T06:27:58+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-ce0df89a405747cda5b7c61ae0b48fb2","complete":true,"records":13633,"lastAttemptAt":"2026-11-08T07:07:08.1374238+00:00","lastSuccessAt":"2026-11-08T05:08:40.263+00:00","error":null,"lastVerifiedAt":"2026-11-08T05:08:40.263+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-08T07:06:42.2208240+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-08T07:06:42.220824+00:00","lastSuccessAt":"2026-11-08T07:06:42.3846752+00:00","error":null,"lastVerifiedAt":"2026-11-08T07:06:42.3846753+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-e34772fb6aa347ef91ff9834fc6c39c0","complete":true,"records":13645,"lastAttemptAt":"2026-11-08T07:07:07.5391052+00:00","lastSuccessAt":"2026-11-08T07:07:07.536+00:00","error":null,"lastVerifiedAt":"2026-11-08T07:07:07.536+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0eb4d6dde62dffacd040ad992d4fd5a65cd7d0dc5f5f4cfa8b41967fc6f9ca5f","complete":true,"records":9914,"lastAttemptAt":"2026-11-08T07:06:42.0654366+00:00","lastSuccessAt":"2026-11-06T20:10:36.6450506+00:00","error":null,"lastVerifiedAt":"2026-11-08T07:06:42.0654366+00:00","snapshotPublishedAt":"2026-11-06T20:02:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-08T07:06:41.8609231+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-08T07:06:41.8609231+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-335633e78a15c9cde10a6025895b5617717087fb945489ae7e15d377bacf34a9","complete":true,"records":3055,"lastAttemptAt":"2026-11-08T07:06:42.179579+00:00","lastSuccessAt":"2026-11-06T16:03:00.7615789+00:00","error":null,"lastVerifiedAt":"2026-11-08T07:06:42.179579+00:00","snapshotPublishedAt":"2026-11-06T16:02:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-40ad6183a951565ace1520a9b4d631e1d0bfb1d4bf7c5574c375032559f3ff53","complete":true,"records":231292,"lastAttemptAt":"2026-11-08T07:06:41.9639328+00:00","lastSuccessAt":"2026-11-07T10:29:00.4821259+00:00","error":null,"lastVerifiedAt":"2026-11-08T07:06:41.9639328+00:00","snapshotPublishedAt":"2026-11-07T09:32:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}