---
id: CVE-2026-109364
title: >-
  Zebra 2.3.0 before 6.4.0 contains a protection mechanism failure that allows
  unauthenticated peers to evade bans because bans and misbehavior scores are
  keyed on exact IP addresses
summary: >-
  Zebra 2.3.0 before 6.4.0 contains a protection mechanism failure that allows
  unauthenticated peers to evade bans because bans and misbehavior scores are
  keyed on exact IP addresses. Attackers can reconnect from fresh IPv6 addresses
  in th…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-693
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T17:17:34.103'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-109364'
references:
  - url: >-
      https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-jhpp-8h75-7pv5
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/zebra-2.3.0-before-6.4.0-peer-ban-bypass-via-exact-ip-keying
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-12T18:00:08.215Z'
---

## Overview

Zebra 2.3.0 before 6.4.0 contains a protection mechanism failure that allows unauthenticated peers to evade bans because bans and misbehavior scores are keyed on exact IP addresses. Attackers can reconnect from fresh IPv6 addresses in their /64 allocation or flush the 20,000-entry FIFO ban list to restore access for banned peers.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.