Memeshort retweeted
$ZEC @Zcash vulnerability #3
Zebra only allows 500 new transactions to download at once. It also tries to limit any single peer to 5 of those slots.
The crawler path never attaches the peer’s identity, so the 5-slot limit does not run. One ordinary peer can dump a long list of fake transaction IDs and fill every slot.
The process stays up. CPU and memory look fine. Real user transactions stop being accepted. Wallets, merchants, and exchanges relying on that node stop seeing transfers go through.
This path was left open after the earlier CVE-2026-52732 fix. zcashd is not affected.
The node looks healthy and is effectively offline for new payments.
Full writeup: memeshortfun.github.io/2026/…
Memeshort retweeted
$ZEC @Zcash vulnerability #2
Zebra v6.3.0 has a debug endpoint called /filter. If it is turned on and reachable from the network, anyone can hit it. No password.
There is no size limit on the request. In our test a 38 MB upload pushed memory near 2 GB and the operating system killed the process. Restart does not close the hole — the same request works again.
This is not on by default. It only exists when two specific options are enabled and the port is exposed. When those conditions are met, one request is enough to take the node down and keep taking it down.
A live $ZEC node that can be killed on demand is not a reliable part of the network.
Full writeup: memeshortfun.github.io/2026/…
