CVE-2026-40881

OVERVIEW CVE-2026-40881 is a memory exhaustion vulnerability affecting Zebra, a Zcash node implementation written in Rust. The flaw exists in versions prior to zebrad 4.3.0 and zebra-network 5.0.1, occurring during deserialization of addr and addrv2 network messages. Zebra allocates memory for vectors up to approximately 233,000 addresses based on the 2 MiB message size limit, rather than enforcing the protocol specification limit of 1,000 messages, allowing excessive memory allocation before validation occurs. SEVERITY The vulnerability employs a network attack vector with low complexity, requiring only the transmission of specially crafted messages over multiple connections. An attacker can trigger out-of-memory conditions that cause Zebra nodes to abort, resulting in denial of service. While no CVSS score is currently assigned, the FAUCET risk score of 35.0 out of 100 indicates moderate concern, and the EPSS probability of 0.0004 suggests minimal real-world exploitation likelihood relative to the overall CVE landscape. EXPLOITATION STATUS There is no evidence of active exploitation, with the vulnerability remaining inactive on threat intelligence hot lists. No public exploit code is documented, and community attention appears minimal. The issue has been resolved through patched releases, making exploitation only possible against unpatched legacy instances of Zebra running older versions.