Zcash Foundation Zebra resource exhaustion in P2P codec

Severity: low · CVSS 3.7 · Published 2026-07-02

Zebra, a Zcash node implementation, contains a flaw in how it handles incoming network connections. An attacker could send a small message that causes the software to reserve a large amount of virtual memory before completing a security handshake. While this could theoretically lead to resource exhaustion, existing security measures like connection limits and timeouts make a successful attack unlikely to impact service availability.

Technologies: zebra-network (crates.io), zebrad (crates.io). Vendors: crates.io.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
Low severity, with a CVSS score of 3.7, published 2 July 2026.
Which products and versions are affected?
zebra-network (crates.io) <= 6.0.0; zebrad (crates.io) <= 4.4.1.
Is there a fix for This vulnerability?
A patch was published on 2026-07-02. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network, in a software library.
Am I affected?
Check whether you run zebra-network (crates.io) or zebrad (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the P2P codec's Codec::decode() method in zebra-network. The component calls src.reserve() using an attacker-supplied body_len field from a 24-byte protocol header before the handshake completes. This allows a remote peer to reserve up to ~2 MiB of virtual buffer capacity per connection. The impact is mitigated because BytesMut::reserve() affects virtual address space rather than physical RAM until data is written, and Zebra employs per-IP connection limits and a 3-second handshake timeout. The issue is fixed in zebra-network 7.0.0 and zebrad 4.5.0 by deferring or capping reservations for pre-handshake messages.

Affected products

  • ZcashFoundation zebra-network <= 6.0.0
  • ZcashFoundation zebrad <= 4.4.1

Timeline

  • 2026-05-29: disclosed: Reported via private GitHub Security Advisory submission
  • 2026-07-02: advisory: GitHub Advisory published
  • 2026-07-02: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.