CVE-2026-104429: Allocation of Resources Without Limits or Throttling in ZcashFoundation zebra
Zebra (zebrad) 5.0.0 before 6.0.0-rc.0 does not apply its per-peer mempool admission cap to transactions received as direct P2P tx messages, because these are queued without the sending peer recorded as their source. A remote inbound peer can push many unique transactions to occupy a disproportionate share of mempool admission slots, crowding out honest peers' transaction relay.
AI Analysis
Technical Summary
Zebra (zebrad) versions >=0 and <6.0.0-rc.0 do not enforce their per-peer mempool admission limits on transactions received via direct P2P transaction messages. These transactions are queued without associating them with the sending peer, enabling a remote inbound peer to flood the mempool with unique transactions. This resource allocation flaw can lead to denial of fair transaction relay opportunities for honest peers by occupying excessive mempool admission slots.
Potential Impact
A remote unauthenticated attacker can exploit this vulnerability to consume disproportionate mempool resources by flooding the node with unique transactions. This can degrade the node's ability to relay transactions from legitimate peers, potentially impacting network transaction propagation and node performance. There is no indication of direct code execution or data corruption.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, monitoring for unusual transaction flooding and limiting exposure to untrusted peers may help mitigate impact.
CVE-2026-104429: Allocation of Resources Without Limits or Throttling in ZcashFoundation zebra
Description
Zebra (zebrad) 5.0.0 before 6.0.0-rc.0 does not apply its per-peer mempool admission cap to transactions received as direct P2P tx messages, because these are queued without the sending peer recorded as their source. A remote inbound peer can push many unique transactions to occupy a disproportionate share of mempool admission slots, crowding out honest peers' transaction relay.
CVSS v4.0
Score 6.9medium
Affected software
ZcashFoundation
zebra
pkg:github/zcashfoundation/zebraRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Zebra (zebrad) versions >=0 and <6.0.0-rc.0 do not enforce their per-peer mempool admission limits on transactions received via direct P2P transaction messages. These transactions are queued without associating them with the sending peer, enabling a remote inbound peer to flood the mempool with unique transactions. This resource allocation flaw can lead to denial of fair transaction relay opportunities for honest peers by occupying excessive mempool admission slots.
Potential Impact
A remote unauthenticated attacker can exploit this vulnerability to consume disproportionate mempool resources by flooding the node with unique transactions. This can degrade the node's ability to relay transactions from legitimate peers, potentially impacting network transaction propagation and node performance. There is no indication of direct code execution or data corruption.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, monitoring for unusual transaction flooding and limiting exposure to untrusted peers may help mitigate impact.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-02T00:46:23.831Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6abf99b0a43b0b3b89b26943
Added to database: 10/02/2026, 11:46:56 UTC
Last enriched: 10/02/2026, 12:02:23 UTC
Last updated: 10/03/2026, 03:10:17 UTC
Views: 13
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.