CVE-2026-109364: Protection Mechanism Failure in ZcashFoundation zebra
Description
Zebra versions 2.3.0 up to but not including 6.4.0 have a protection mechanism failure that allows unauthenticated peers to bypass bans. This occurs because bans and misbehavior scores are keyed on exact IP addresses, enabling attackers to evade bans by reconnecting from new IPv6 addresses within their /64 allocation or by flushing the 20,000-entry FIFO ban list.
CVSS v4.0
Score 6.9medium
Affected software
ZcashFoundation
zebra
pkg:github/zcashfoundation/zebraRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-109364 describes a vulnerability in ZcashFoundation's Zebra software where the ban mechanism relies on exact IP addresses. Since IPv6 addresses within a /64 subnet can be changed easily by an attacker, this allows them to evade bans and misbehavior scoring. Additionally, the ban list is implemented as a 20,000-entry FIFO queue, which can be flushed to restore access for banned peers. This flaw affects Zebra versions from 2.3.0 up to but not including 6.4.0.
Potential Impact
Attackers can circumvent bans and misbehavior penalties by using fresh IPv6 addresses within their allocated /64 subnet or by flushing the ban list, potentially allowing continued disruptive or malicious activity without restriction. This undermines the effectiveness of Zebra's peer banning and network protection mechanisms.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor vendor communications for official fixes or temporary mitigations addressing this issue.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-12T14:21:32.595Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6acd0c192cdf04f656b11c1b
Added to database: 10/12/2026, 16:34:33 UTC
Last enriched: 10/12/2026, 16:48:49 UTC
Last updated: 10/12/2026, 21:46:37 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.