CVE-2026-52732: zebrad has mempool transaction admission denial via single-peer inbound queue saturation

July 2, 2026

A single unauthenticated P2P peer can monopolize all 25 inbound mempool download/verification slots (MAX_INBOUND_CONCURRENCY) by advertising fake transaction IDs. While the slots are occupied, all other inbound transactions from honest peers and local RPC sendrawtransaction calls are rejected with MempoolError::FullQueue. The attacker peer is never scored for misbehavior and is not disconnected, allowing sustained denial of mempool admission.

References

github.com/ZcashFoundation/zebra/blob/d4cd662c716382f6397d2a730148025a1ca79fec/zebrad/src/components/mempool/downloads.rs
github.com/ZcashFoundation/zebra/security/advisories/GHSA-4fc2-h7jh-287c
github.com/advisories/GHSA-4fc2-h7jh-287c
nvd.nist.gov/vuln/detail/CVE-2026-52732

Code Behaviors & Features

Detect and mitigate CVE-2026-52732 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →