How a timeout arm that carries no transaction id leaks a Zcash node to death
##The bug
Zebra (zebrad, the Zcash Foundation's Rust full node) downloads mempool transactions through a pipeline that keeps a cancel_handles map — one entry, up to ~2 MB, per in-flight download.
When a download times out, the timeout arm returns without removing its `cancel_handles` entry. The reason is subtle: the tokio Elapsed error carries no transaction id, so the cleanup path has nothing to key the removal on and simply bails.
Any code path that can insert into a map but not always remove from it is a memory leak waiting for an adversary to find the fast path.
##Why it's remotely exploitable
The download pipeline is fed by unauthenticated P2P traffic. An attacker who trickles advertised-but-undeliverable transactions keeps the pipeline timing out, leaking roughly 685 KB/s per connection — steady, unbounded, and multiplied across connections — until the node is OOM-killed.
##Disposition
Reported as a coordinated disclosure to the Zcash Foundation, assigned CVE-2026-52734 (advisory GHSA-65jj-fmw8-468q), and fixed in zebrad 4.5.0 (affected <= 4.4.1).