Zcash Zebra EUVD-2026-91440

Exploitation requires the attacker to be an inbound P2P peer that can send direct 'tx' protocol messages to a Zebra node running a version in the 5.0.0-to-before-6.0.0-rc.0 range; the flaw is triggered specifically by transactions delivered as direct P2P tx messages (not relayed/advertised via inv), because those are queued without the sending peer recorded as their source, so the per-peer mempool admission cap is never applied. No authentication, user interaction, or special configuration is needed - any node reachable for inbound P2P connections on the Zcash network is exposed. The practical limiter is impact rather than access: the effect is degraded/crowded-out honest transaction relay (availability of mempool slots), not node compromise or crash, and operators on 6.0.0-rc.0 or later are not affected.

This is a resource-exhaustion denial-of-service (CWE-770) with genuinely modest real-world risk, consistent with its 6.9 Medium CVSS 4.0 score. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates a remote, unauthenticated, low-complexity attack requiring no user interaction, which is why the score is not lower; however, the impact metrics are the key limiter: VC:N/VI:N/VA:L with no subsequent-system impact means only a LOW availability effect - the attacker crowds out honest transaction relay but does not crash the node, corrupt data, or breach confidentiality/integrity. No EPSS score was provided, so exploitation probability cannot be quantified. The CVE is NOT in CISA KEV and no proof-of-concept is referenced, so exploitation status is 'no public exploit identified at time of analysis.' The attack degrades mempool fairness rather than causing outright outage, so despite the clean network/unauthenticated vector this is a reliability/fairness defect rather than an urgent security emergency. Signals are internally consistent - no conflict between vector and description - the main gap is the absence of EPSS and any exploitation evidence. Patch availability (6.0.0-rc.0) makes this a straightforward upgrade-when-convenient item for Zebra node operators rather than an emergency patch.

A malicious node connects to a target Zebra (zebrad) instance as an inbound P2P peer and streams many unique, valid transactions via direct 'tx' messages. Because these transactions are queued without recording the sending peer as their source, the per-peer mempool admission cap is never applied, letting the attacker occupy a disproportionate share of admission slots and starve legitimate peers' transaction relay. No proof-of-concept is publicly referenced, but the attack requires no authentication and only standard P2P connectivity.