CVE-2026-52732

Name of the Vulnerable Software and Affected Versions ZEBRA versions prior to 4.5.0

Description An unauthenticated P2P peer can monopolize all 25 MAX INBOUND CONCURRENCY slots in the inbound mempool download and verification pipeline. This occurs because the bounded queue in zebrad/src/components/mempool/downloads.rs is shared globally without per-peer accounting, and peer identity is not carried through the Gossip type. Additionally, FullQueue responses are mapped to Response::Nil in zebrad/src/components/inbound.rs, preventing overload disconnection handling from triggering.

An attacker can exploit this by advertising fake transaction identifiers and remaining silent, causing each task to hold a slot until the TRANSACTION DOWNLOAD TIMEOUT expires. Other methods include using invalid-prevout transactions that remain in AwaitOutput for 60 seconds or utilizing expensive shielded proof verification. While the slots are saturated, honest peer transactions and local sendrawtransaction requests are rejected with MempoolError::FullQueue. Block validation and synchronization remain unaffected.

Recommendations Update ZEBRA to version 4.5.0.