Per-Peer Mempool Admission Bypass in Zebra by Zcash Foundation
CVE-2026-104429

6.9MEDIUM

Key Information:

Vendor

Zcashfoundation

Status
Zebra
Vendor
CVE Published:
2 October 2026

What is CVE-2026-104429?

Zebra versions prior to 6.0.0-rc.0 are susceptible to a vulnerability that allows remote peers to circumvent the per-peer mempool admission cap. This issue arises when unique transactions are received as direct P2P messages, where the sending peer is not recorded. Malicious peers can exploit this by overwhelming the mempool, thus preventing legitimate peers from successfully relaying their transactions.

Affected Version(s)

zebra 0 < 6.0.0-rc.0

zebra 6.0.0-rc.0

References

https://github.com/ZcashFoundation/zebra/security/advisor...
vendor-advisory
https://www.vulncheck.com/advisories/zebra-before-6.0.0-r...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

SuplabsYi
upbqdn
oxarbitrage
mpguerra
.