The vulnerability in zebrad's mempool download pipeline arises from a bug where the cancel_handles map retains entries for transactions that time out during verification. Specifically, when a verification task times out (tokio::time::error::Elapsed), the transaction ID is lost because the error carries no payload, preventing removal of the corresponding entry. These entries include the full deserialized transaction (up to ~9 MB), accumulating without bound and causing memory exhaustion. The only cleanup occurs on mined transactions or node shutdown, neither of which addresses timed-out transactions. The fix involves preserving the transaction ID through the timeout error path and removing the entry upon timeout. No configuration workaround exists; only node restart clears the memory.

This vulnerability leads to gradual, unbounded memory exhaustion on zebrad nodes accepting inbound P2P connections with active mempools. Memory usage grows monotonically as timed-out transactions accumulate in memory, potentially causing the operating system's out-of-memory killer to terminate the process or degrade node performance due to swap pressure. The leak rate is approximately 685 KB/s per connection in worst-case scenarios, requiring sustained attacker traffic over hours to exhaust typical server memory. There is no impact on consensus, no loss of funds, and no on-disk data corruption.

A patch is available in zebrad versions 4.5.0 and later that fixes the memory leak by preserving the transaction ID on timeout and removing the corresponding entry. Operators should upgrade to version 4.5.0 or later to remediate this issue. There is no configuration-level workaround. Restarting the node clears accumulated entries but does not prevent recurrence. Operators in memory-constrained environments should consider upgrading promptly to avoid out-of-memory termination.