# CVE-2026-104429: Zebra per-peer mempool admission bypass in P2P transaction handling

Source: https://junglewise.ai/threats/cve-2026-104429-zebra-zebrad-5-0-0-before-6-0-0-rc-0-does-not-apply-its-per-peer  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-02. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-104429 · Severity: medium · CVSS 5.3 · Published 2026-10-02

Zebra is a cryptocurrency node implementation for the Zcash network. A remote attacker can bypass fairness controls on transaction relay by sending transactions as direct P2P messages instead of advertisements, allowing them to monopolize inbound transaction processing capacity. This degrades honest peers' ability to relay their transactions through the network.

Technologies: [Zcash Foundation Zebra](https://junglewise.ai/threats/technologies/zebra). Vendors: [Zcash Foundation](https://junglewise.ai/threats/vendors/zcash-foundation).

## Quick answers

**Is CVE-2026-104429 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-104429 being exploited in the wild.

**How severe is CVE-2026-104429?** Medium severity, with a CVSS score of 5.3, published 2 October 2026.

**Which products and versions are affected?** Zcash Foundation Zebra 5.0.0 before 6.0.0-rc.0.

**Is there a fix for CVE-2026-104429?** Yes: fixed in 6.0.0-rc.0. Until then: Operators can reduce exposure by disabling inbound P2P connections or restricting inbound peers to trusted hosts, though this degrades network connectivity. Upgrade to the patched release once available. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-104429 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-104429?** Check whether you run Zcash Foundation Zebra at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 6.0.0-rc.0

Operators can reduce exposure by disabling inbound P2P connections or restricting inbound peers to trusted hosts, though this degrades network connectivity. Upgrade to the patched release once available.

## Technical details

The vulnerability exists in Zebra's mempool admission accounting: direct P2P transaction messages (Message::Tx) are converted to internal push requests without preserving the sending peer's address, causing them to bypass the per-peer admission cap (MAX_INBOUND_CONCURRENCY_PER_PEER = 5) and only be constrained by the global cap. A remote unauthenticated peer can send many unique transactions and hold more than its intended five concurrent admission slots, delaying or dropping honest peers' transaction gossip. The fix requires preserving the peer address for directly pushed transactions and routing them through the same per-peer accounting used for advertised transactions.

## Affected products

- Zcash Foundation Zebra 5.0.0 before 6.0.0-rc.0

## Timeline

- 2026-07-03: disclosed
- 2026-10-02: advisory

## References

- [https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-m9xx-8rcj-vmgp](https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-m9xx-8rcj-vmgp)
- [https://www.vulncheck.com/advisories/zebra-before-6.0.0-rc.0-per-peer-mempool-admission-bypass-via-p2p-tx-messages](https://www.vulncheck.com/advisories/zebra-before-6.0.0-rc.0-per-peer-mempool-admission-bypass-via-p2p-tx-messages)

## Related threats

- [Zebra incomplete cleanup in checkpoint sync stalls initial sync](https://junglewise.ai/threats/cve-2026-123560-zebra-before-7-0-0-contains-an-incomplete-cleanup-vulnerability)
- [Zebra denial of service via quadratic sighash computation](https://junglewise.ai/threats/cve-2026-123559-zebra-before-7-0-0-contains-an-inefficient-algorithmic)
- [Zcash Foundation Zebra zebrad reachable assertion denial of service](https://junglewise.ai/threats/cve-2026-123557-zcashfoundation-zebra-zebrad-before-7-0-0-contains-a-reachable)
- [Zcash Foundation Zebra protection mechanism failure in mempool lock-time scoring](https://junglewise.ai/threats/cve-2026-123556-zcashfoundation-zebra-from-4-5-0-before-7-0-0-contains-a)
- [Zebra misbehavior scoring bypass via invalid script verification](https://junglewise.ai/threats/cve-2026-123555-zebra-from-2-3-0-before-7-0-0-contains-a-denial-of-service)