Zebrad, a Zcash node implementation in Rust, improperly handles deserialization of addr and addrv2 messages containing vectors of addresses. It allocates memory based on a maximum length derived from a 2 MiB message size limit (over 233,000 entries), which exceeds the protocol's actual limit of 1,000 messages. Although the software eventually checks the correct limit, the large memory allocation occurs beforehand, enabling an attacker to cause out-of-memory conditions by sending multiple such messages across different connections. This is classified as CWE-770: Allocation of Resources Without Limits or Throttling. The issue is resolved in zebrad 4.3.0 and zebra-network 5.0.1.

An attacker can cause zebrad nodes to consume excessive memory by sending specially crafted addr or addrv2 messages, potentially leading to out-of-memory aborts and denial of service. This could disrupt node availability but does not indicate direct compromise or data loss. No known exploits in the wild have been reported.

The vulnerability is fixed in zebrad version 4.3.0 and zebra-network version 5.0.1. Users should upgrade to these or later versions to remediate the issue. Patch status is not explicitly confirmed in the provided data, so verify with the official vendor advisory for the latest remediation guidance.