All vulnerabilities
CVE-2026-109364GHSA-jhpp-8h75-7pv5

Zebra 2.3.0 before 6.4.0 Peer Ban Bypass via Exact-IP Keying

ZcashFoundation zebra
Open in ThreatlineRecord JSON
CVSS
6.9Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.24%Chance of exploitation activity in the next 30 days, higher than 13% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in6.4.0Fixed versionCVE List
Published12 Oct 2026Updated 13 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Zebra 2.3.0 before 6.4.0 contains a protection mechanism failure that allows unauthenticated peers to evade bans because bans and misbehavior scores are keyed on exact IP addresses. Attackers can reconnect from fresh IPv6 addresses in their /64 allocation or flush the 20,000-entry FIFO ban list to restore access for banned peers.

Text from CVE List

Affected versions 2

  • zebraaffected: 2.3.0 before 6.4.0CVE List
  • zebraunaffected: 6.4.0CVE List

References 2