CVE-2026-52732

ZEBRA (zebrad), a Zcash node written in Rust, is vulnerable to mempool transaction admission denial via single-peer inbound queue saturation in versions prior to 4.5.0 . A single unauthenticated P2P peer can monopolize all 25 MAX_INBOUND_CONCURRENCY slots in the inbound mempool download/verificat...

Zebra has Permanent Block Discovery Halt via Gossip Queue Saturation and Syncer Poisoning

Summary A composite denial-of-service vulnerability in Zebra's block discovery pipeline allows an unauthenticated remote attacker to permanently halt all new block discovery on a targeted node. The attack exploits three independent weaknesses in the gossip, syncer, and download subsystems — all...

CVE-2024-7768 Denial of Service in h2oai/h2o-3

A vulnerability in the /3/ImportFiles endpoint of h2oai/h2o-3 version 3.46.1 allows an attacker to cause a denial of service. The endpoint takes a single GET parameter, path, which can be recursively set to reference itself. This leads the server to repeatedly call its own endpoint, eventually...