CVE-2026-104429: Zebra before 6.0.0-rc.0 Per-Peer Mempool Admission Bypass via P2P tx Messages

Q: Which deployments are exposed?

Zebrad versions 5.0.0 before 6.0.0-rc.0 are affected. Exposure requires the node to accept inbound P2P peers that can send direct transaction messages.

Q: What does an attacker need to exploit this issue?

An attacker needs only remote network access as an inbound P2P peer; no privileges or user interaction are required. They can send many unique transactions using direct P2P tx messages.

Q: What is the operational impact?

The attacker can consume a disproportionate share of mempool admission slots because the per-peer admission cap is not applied to these transactions. This can crowd out transaction relay from honest peers and cause an availability impact.

Q: How can I tell whether my node is affected?

A node is affected if it runs zebrad 5.0.0 or a later version that is still before 6.0.0-rc.0. The vulnerable behavior specifically involves direct P2P transaction messages being queued without the sending peer recorded as their source.

Published Oct 2, 2026

Updated

Zebra (zebrad) 5.0.0 before 6.0.0-rc.0 does not apply its per-peer mempool admission cap to transactions received as direct P2P tx messages, because these are queued without the sending peer recorded as their source. A remote inbound peer can push many unique transactions to occupy a disproportionate share of mempool admission slots, crowding out honest peers' transaction relay.

Affected Software

1 affected component

Zebra zebrad>=5.0.0<6.0.0-rc.0

Event History

Oct 2, 2026

CVE Published

via MITRE·11:38 AM

Data Sourced

via MITRE·11:38 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·12:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Zebrad versions 5.0.0 before 6.0.0-rc.0 are affected. Exposure requires the node to accept inbound P2P peers that can send direct transaction messages.

What does an attacker need to exploit this issue?

An attacker needs only remote network access as an inbound P2P peer; no privileges or user interaction are required. They can send many unique transactions using direct P2P tx messages.

What is the operational impact?

The attacker can consume a disproportionate share of mempool admission slots because the per-peer admission cap is not applied to these transactions. This can crowd out transaction relay from honest peers and cause an availability impact.

How can I tell whether my node is affected?

A node is affected if it runs zebrad 5.0.0 or a later version that is still before 6.0.0-rc.0. The vulnerable behavior specifically involves direct P2P transaction messages being queued without the sending peer recorded as their source.

CVE-2026-104429: Zebra before 6.0.0-rc.0 Per-Peer Mempool Admission Bypass via P2P tx Messages

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What is the operational impact?

How can I tell whether my node is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What is the operational impact?

How can I tell whether my node is affected?