CVE-2026-52734

Name of the Vulnerable Software and Affected Versions ZEBRA versions prior to 4.5.0

Description An unauthenticated P2P peer can cause monotonic memory growth in a Zcash node, leading to process termination by the operating system due to memory exhaustion or performance degradation from swap pressure. The issue occurs in the mempool download pipeline within the Downloads::poll next() function located in zebrad/src/components/mempool/downloads.rs. When verification reaches the outer RATE LIMIT DELAY timeout, the system fails to remove the corresponding entry from the cancel handles map because the tokio::time::error::Elapsed error does not provide the UnminedTxId required for removal. Since these entries can hold a full Gossip::Tx(UnminedTx) and there is no periodic garbage collection or count cap, memory is leaked continuously as long as the attacker sustains traffic.

Recommendations Update ZEBRA to version 4.5.0. As a temporary workaround, restart the node to clear accumulated memory entries.