Protection Mechanism Failure in Zebra by Zcash Foundation Allows Unauthorized Access
CVE-2026-109364

6.9MEDIUM

Key Information:

Vendor

Zcashfoundation

Status
Zebra
Vendor
CVE Published:
12 October 2026

What is CVE-2026-109364?

Zebra versions prior to 6.4.0 are affected by a vulnerability that allows unauthorized users to bypass IP bans due to the reliance on exact IP addresses for enforcing bans and misbehavior scores. Attackers can exploit this by connecting through fresh IPv6 addresses within their /64 allocation or by utilizing techniques to clear ban lists, effectively regaining access to the network after being previously banned.

Affected Version(s)

zebra 2.3.0 < 6.4.0

zebra 6.4.0

References

https://github.com/ZcashFoundation/zebra/security/advisor...
vendor-advisory
https://www.vulncheck.com/advisories/zebra-2.3.0-before-6...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

conradoplg
mpguerra
.