The vulnerability exists in Zebra's P2P codec where the decode method reserves buffer capacity based on the body length field claimed by an attacker in the protocol header before the handshake completes. This reservation can be up to approximately 2 MiB of virtual memory per connection. However, since physical memory is not allocated until data is written, and the attacker can avoid sending body bytes, the impact on actual memory usage is negligible. Zebra's mitigations, including per-IP connection limits, accept rate limits, and handshake timeouts, further reduce the attack surface. The fix involves deferring large buffer reservations until after handshake completion or limiting reservation size for pre-handshake messages.

The vulnerability only affects virtual address space reservation without allocating physical memory, resulting in minimal impact. Existing mitigations such as limiting connections per IP, handshake timeouts, and connection accept rates effectively prevent practical denial-of-service. There is no measurable increase in resource usage or service disruption demonstrated by the reporter's proof of concept.

A fix is available that defers large buffer reservations until after handshake completion or caps the reservation size for pre-handshake messages. No workaround is necessary as existing per-IP connection limits, handshake timeouts, and accept rate limits effectively mitigate the practical impact. Users should apply the official fix when available to improve defense-in-depth.