CVE-2026-52734 ZcashFoundation CVE debrief

Who should care

Zebrad node operators and defenders should assess exposure and prioritize upgrading to version 4.5.0 or later to prevent potential memory exhaustion attacks. The vulnerability could lead to DoS attacks and requires verification of current version and exposure. Affected operators, platforms, vulnerability-management, and security teams should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Why it matters

CVE-2026-52734 allows unauthenticated P2P peers to cause memory growth in ZEBRA Zcash nodes. Zebrad node operators should assess exposure and upgrade to version 4.5.0 or later to prevent potential memory exhaustion attacks. The vulnerability could lead to DoS attacks and requires verification of current version and exposure.

• Memory exhaustion could degrade node performance or lead to process termination.
• Potential for denial-of-service (DoS) attacks through sustained traffic.
• Need for verification of current ZEBRA version and exposure.
• Prioritization of upgrade to version 4.5.0 or later.

Technical summary

The vulnerability in ZEBRA, a Zcash node written in Rust, allows an unauthenticated P2P peer to cause the mempool download pipeline to retain transactions after verification reaches the outer RATE_LIMIT_DELAY timeout. This leads to monotonic memory growth until swap pressure degrades the node or the operating system terminates the zebrad process for exhausting memory. The issue is fixed in version 4.5.0.

Defensive priority

Defenders should prioritize upgrading to version 4.5.0 or later to prevent potential memory exhaustion attacks. Zebrad node operators should assess exposure and verify their current version.

Recommended defensive actions

• Upgrade to ZEBRA version 4.5.0 or later
• Verify current ZEBRA version and assess exposure
• Monitor for potential memory exhaustion attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fix in version 4.5.0. Official source references from GitHub support the information. The vulnerability allows unauthenticated P2P peers to cause memory growth in ZEBRA Zcash nodes. The issue is fixed in version 4.5.0. There is no evidence of public exploitation, but defenders should verify their current version and assess exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.