Executive brief
Zebra, a Zcash node implementation, contains a flaw in how it handles incoming network connections. An attacker could send a small message that causes the software to reserve a large amount of virtual memory before completing a security handshake. While this could theoretically lead to resource exhaustion, existing security measures like connection limits and timeouts make a successful attack unlikely to impact service availability.
Technical details
A vulnerability exists in the P2P codec's Codec::decode() method in zebra-network. The component calls src.reserve() using an attacker-supplied body_len field from a 24-byte protocol header before the handshake completes. This allows a remote peer to reserve up to ~2 MiB of virtual buffer capacity per connection. The impact is mitigated because BytesMut::reserve() affects virtual address space rather than physical RAM until data is written, and Zebra employs per-IP connection limits and a 3-second handshake timeout. The issue is fixed in zebra-network 7.0.0 and zebrad 4.5.0 by deferring or capping reservations for pre-handshake messages.
Affected products
- ZcashFoundation zebra-network <= 6.0.0
- ZcashFoundation zebrad <= 4.4.1
Timeline
- 2026-05-29: disclosed: Reported via private GitHub Security Advisory submission
- 2026-07-02: advisory: GitHub Advisory published
- 2026-07-02: patched