CVE-2026-109364
5.3MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-693
Impact
Remote unauthenticated peers can bypass node bans and misbehavior scoring by rotating through fresh IPv6 addresses or by flooding the FIFO ban list to flush existing entries. Attackers only need network reachability to the node's listening peer-to-peer port.
Root cause
Ban tracking and misbehavior scores are keyed strictly to exact individual IP addresses instead of subnets, combined with a fixed 20,000-entry FIFO ban list limit.
Affected systems
Zebra 2.3.0 before 6.4.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Fix & remediation
Upgrade Zebra to version 6.4.0 or later. If patching immediately is not possible, block offending peer network ranges or IPv6 /64 subnets upstream at the host firewall.
$ cargo install --locked zebrad --version 6.4.0AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Zebra 2.3.0 before 6.4.0 contains a protection mechanism failure that allows unauthenticated peers to evade bans because bans and misbehavior scores are keyed on exact IP addresses. Attackers can reconnect from fresh IPv6 addresses in their /64 allocation or flush the 20,000-entry FIFO ban list to restore access for banned peers.