CVE-2026-104429: Zcashfoundation Zebra

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

Zebra (zebrad) 5.0.0 before 6.0.0-rc.0 does not apply its per-peer mempool admission cap to transactions received as direct P2P tx messages, because these are queued without the sending peer recorded as their source. A remote inbound peer can push many unique transactions to occupy a disproportionate share of mempool admission slots, crowding out honest peers' transaction relay.

Affected products

• Zcashfoundation Zebra: before 6.0.0-rc.0 (fixed in 6.0.0-rc.0)

Published 2026-10-02. Last modified 2026-10-02.