CVE-2026-52732: zebrad has mempool transaction admission denial via single-peer inbound queue saturation

July 2, 2026

A single unauthenticated P2P peer can monopolize all 25 inbound mempool download/verification slots (MAX_INBOUND_CONCURRENCY) by advertising fake transaction IDs. While the slots are occupied, all other inbound transactions from honest peers and local RPC sendrawtransaction calls are rejected with MempoolError::FullQueue. The attacker peer is never scored for misbehavior and is not disconnected, allowing sustained denial of mempool admission.

References

github.com/ZcashFoundation/zebra/blob/d4cd662c716382f6397d2a730148025a1ca79fec/zebrad/src/components/mempool/downloads.rs
github.com/ZcashFoundation/zebra/security/advisories/GHSA-4fc2-h7jh-287c
github.com/advisories/GHSA-4fc2-h7jh-287c
nvd.nist.gov/vuln/detail/CVE-2026-52732

Code Behaviors & Features

Detect and mitigate CVE-2026-52732 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →