CyberRota Analysis
AI-GeneratedZEBRA, a Zcash node implemented in Rust, is vulnerable to a denial-of-service attack where an unauthenticated peer can monopolize inbound concurrency slots, leading to the rejection of legitimate transactions. This occurs due to a lack of per-peer accounting in the mempool's download and verification pipeline, allowing attackers to exploit the system by advertising fake transaction identifiers. Users operating versions prior to 4.5.0 should prioritize upgrading to mitigate this risk and ensure the integrity of transaction processing.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, one unauthenticated P2P peer can monopolize all 25 MAX_INBOUND_CONCURRENCY slots in Zebra's inbound mempool download and verification pipeline. In zebrad/src/components/mempool/downloads.rs, the bounded queue was shared globally without per-peer accounting, while peer identity was not carried through Gossip and FullQueue responses were mapped to Response::Nil instead of reaching overload disconnection handling. An attacker can advertise fake transaction identifiers and remain silent so each task holds a slot until TRANSACTION_DOWNLOAD_TIMEOUT, then periodically refill the queue as slots expire. While saturated, honest peer transactions and local sendrawtransaction requests are rejected with MempoolError::FullQueue, although block validation and synchronization continue. This issue is fixed in version 4.5.0.