Vulnerability Description
ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, an unauthenticated P2P peer can cause the mempool download pipeline to retain transactions after verification reaches the outer RATE_LIMIT_DELAY timeout. In zebrad/src/components/mempool/downloads.rs, Downloads::poll_next removed cancel_handles entries after success and ordinary verification errors, but tokio::time::error::Elapsed did not carry the UnminedTxId needed to remove the timed-out entry. Each retained cancel_handles entry could hold a full Gossip::Tx(UnminedTx), while normal mined-transaction cleanup could not match attacker transactions and no periodic garbage collection or count cap existed. Sustained traffic therefore caused monotonic memory growth until swap pressure degraded the node or the operating system terminated the zebrad process for exhausting memory. This issue is fixed in version 4.5.0.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/ZcashFoundation/zebra/commit/1440b43ca7df59aca948090d45117557
- https://github.com/ZcashFoundation/zebra/releases/tag/v4.5.0
- https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-65jj-fmw8-468q
FAQ
What is CVE-2026-52734?
CVE-2026-52734 is a vulnerability with a CVSS score of 5.3 (MEDIUM). ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, an unauthenticated P2P peer can cause the mempool download pipeline to retain transactions after verification reaches the outer RATE_LIM...
How severe is CVE-2026-52734?
CVE-2026-52734 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-52734?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.