CVE-2026-104429 — Zebra before 6.0.0-rc.0 Per-Peer Mempool Admission Bypass via P2P tx Messages
Zebra (zebrad) 5.0.0 before 6.0.0-rc.0 does not apply its per-peer mempool admission cap to transactions received as direct P2P tx messages, because these are queued without the…
Published: 2026-10-02 · CVSS: 6.9 · CVSS 4.0
Zebra (zebrad) 5.0.0 before 6.0.0-rc.0 does not apply its per-peer mempool admission cap to transactions received as direct P2P tx messages, because these are queued without the sending peer recorded as their source. A remote inbound peer can push many unique transactions to occupy a disproportionate share of mempool admission slots, crowding out honest peers' transaction relay.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7