The CVE program itself is an unauthenticated remote DoS vulnerability

In general, Zelle is highly questionable for almost all purposes. The banks like to pretend[1] that Regulation E does not apply to Zelle, which in plain English means "no chargebacks, no refunds, and we specifically don't want to hear about how you thought he really was the deposed prince of Nigeria." I wouldn't touch Zelle for anything other than giving money to a personal friend or family member.

[1]: See https://www.bitsaboutmoney.com/archive/regulation-e/ for a more precise explanation of what the banks claim and how legally plausible it is. But note that the average consumer is not in a great position to start a legal battle with the average bank.