anticsdecoded|Portfolio
SEC|2026
$ cat zebra-mempool-memory-leak-cve-2026-52734.md
research2026-06-01·6 min

How a timeout arm that carries no transaction id leaks a Zcash node to death

#zcash#rust#mempool#dos#cve

##The bug

Zebra (zebrad, the Zcash Foundation's Rust full node) downloads mempool transactions through a pipeline that keeps a cancel_handles map — one entry, up to ~2 MB, per in-flight download.

When a download times out, the timeout arm returns without removing its `cancel_handles` entry. The reason is subtle: the tokio Elapsed error carries no transaction id, so the cleanup path has nothing to key the removal on and simply bails.

Any code path that can insert into a map but not always remove from it is a memory leak waiting for an adversary to find the fast path.

##Why it's remotely exploitable

The download pipeline is fed by unauthenticated P2P traffic. An attacker who trickles advertised-but-undeliverable transactions keeps the pipeline timing out, leaking roughly 685 KB/s per connection — steady, unbounded, and multiplied across connections — until the node is OOM-killed.

##Disposition

Reported as a coordinated disclosure to the Zcash Foundation, assigned CVE-2026-52734 (advisory GHSA-65jj-fmw8-468q), and fixed in zebrad 4.5.0 (affected <= 4.4.1).

▸ full report