Description
Zebra (zebrad) 5.0.0 before 6.0.0-rc.0 does not apply its per-peer mempool admission cap to transactions received as direct P2P tx messages, because these are queued without the sending peer recorded as their source. A remote inbound peer can push many unique transactions to occupy a disproportionate share of mempool admission slots, crowding out honest peers' transaction relay.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ZcashFoundation | zebra | < 6.0.0-rc.0 | 6.0.0-rc.0 |
References
- GitHub Security Advisory (GHSA-m9xx-8rcj-vmgp) vendor-advisory
- VulnCheck Advisory: Zebra before 6.0.0-rc.0 Per-Peer Mempool Admission Bypass via P2P tx Messages third-party-advisory