P2P Resource Exhaustion in Zcash Node by Zcash Foundation

CVE-2026-52732

What is CVE-2026-52732?

A vulnerability in the ZEBRA node allows an unauthenticated P2P peer to monopolize all MAX_INBOUND_CONCURRENCY slots in the inbound mempool, potentially leading to resource exhaustion. The flaw stems from the global sharing of the bounded queue without per-peer accounting, making it easy for an attacker to advertise false transaction identifiers. Honest peer transactions and local sendrawtransaction requests may be rejected under heavy load, even as block validation and synchronization continue unaffected. This vulnerability is addressed in version 4.5.0.

References