ZEBRA: Unbounded memory leak in mempool download pipeline via timeout path cancel_handles retention

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-52734 · Microsoft / collected KEV context

EUVD-2026-61164

GHSA-65jj-fmw8-468q

cve-program · CVE-2026-52734

• https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-65jj-fmw8-468q
• https://github.com/ZcashFoundation/zebra/commit/1440b43ca7df59aca948090d45117557b217a6cd
• https://github.com/ZcashFoundation/zebra/releases/tag/v4.5.0

euvd · EUVD-2026-61164

• https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-65jj-fmw8-468q
• https://github.com/ZcashFoundation/zebra/commit/1440b43ca7df59aca948090d45117557b217a6cd
• https://github.com/ZcashFoundation/zebra/releases/tag/v4.5.0

nvd · CVE-2026-52734

• https://github.com/ZcashFoundation/zebra/commit/1440b43ca7df59aca948090d45117557b217a6cd
• https://github.com/ZcashFoundation/zebra/releases/tag/v4.5.0
• https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-65jj-fmw8-468q

osv · GHSA-65jj-fmw8-468q

• https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-65jj-fmw8-468q
• https://github.com/ZcashFoundation/zebra
• https://github.com/ZcashFoundation/zebra/blob/d4cd662c716382f6397d2a730148025a1ca79fec/zebrad/src/components/mempool.rs#L663-L672
• https://github.com/ZcashFoundation/zebra/blob/d4cd662c716382f6397d2a730148025a1ca79fec/zebrad/src/components/mempool/downloads.rs#L215-L228

No related operational record is retained in the current change model.