CVE-2026-52732 ZEBRA: Mempool transaction admission denial via single-peer inbound queue saturation

What is CVE-2026-52732?

CVE-2026-52732 is a medium-severity denial of service vulnerability in ZcashFoundation zebra, published on 18 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, one unauthenticated P2P peer can monopolize all 25 MAX_INBOUND_CONCURRENCY slots in Zebra's inbound mempool download and verification pipeline. In zebrad/src/components/mempool/downloads.rs, the bounded queue was shared globally without per-peer accounting, while peer identity was not carried through Gossip and FullQueue responses were mapped to Response::Nil instead of reaching overload disconnection handling. An attacker can advertise fake transaction identifiers and remain silent so each task holds a slot until TRANSACTION_DOWNLOAD_TIMEOUT, then periodically refill the queue as slots expire. While saturated, honest peer transactions and local sendrawtransaction requests are rejected with MempoolError::FullQueue, although block validation and synchronization continue. This issue is fixed in version 4.5.0.

Weakness: CWE-770

Which versions are affected by CVE-2026-52732?

2 open source packages ship an affected version, including zebrad.

How do I fix CVE-2026-52732?

Upgrade zebrad to 4.5.0 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-52732 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-52732 exists.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4fc2-h7jh-287c.