Executive brief
A vulnerability in the Zebra Zcash node software allows a single remote attacker to prevent the node from accepting new transactions. By flooding the node with fake transaction advertisements, an attacker can fill up all available processing slots, causing the node to reject legitimate transactions from other users and local systems. While this disrupts the ability to send new transactions through the affected node, it does not impact the security of funds or the synchronization of the blockchain.
Technical details
The zebrad mempool download and verification pipeline (downloads.rs) uses a bounded pool of 25 concurrent tasks without per-peer accounting or throttling. An unauthenticated remote attacker can monopolize these slots by sending 'inv' messages with fake transaction IDs and then remaining silent, forcing the node to hold the slots until a 20-second timeout occurs. Because the inbound service maps queue-full errors to a null response, existing overload protection and peer disconnection logic are bypassed. The vulnerability is addressed in version 4.5.0 by implementing per-peer queue limits and improved misbehavior attribution.
Affected products
- ZcashFoundation zebrad <= 4.4.1
Timeline
- 2026-05-29: disclosed: Reported via private GitHub Security Advisory
- 2026-07-02: advisory: GitHub Advisory published