{"id":"CVE-2026-104429","published":"2026-10-02T12:17:13.323","lastModified":"2026-10-02T17:59:09.430","description":"Zebra (zebrad) 5.0.0 before 6.0.0-rc.0 does not apply its per-peer mempool admission cap to transactions received as direct P2P tx messages, because these are queued without the sending peer recorded as their source. A remote inbound peer can push many unique transactions to occupy a disproportionate share of mempool admission slots, crowding out honest peers' transaction relay.","cvssScore":5.3,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cwes":["CWE-770"],"vendors":[],"products":[],"references":[{"url":"https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-m9xx-8rcj-vmgp","tags":[]},{"url":"https://www.vulncheck.com/advisories/zebra-before-6.0.0-rc.0-per-peer-mempool-admission-bypass-via-p2p-tx-messages","tags":[]}],"exploitRefs":[{"url":"https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-m9xx-8rcj-vmgp","tags":[]}],"hasPoc":true,"ai":null}