Zebra nodes running versions up to 4.4.1 on Linux with default dual-stack IPv6/IPv4 listeners are vulnerable to a deterministic assertion panic that aborts the process. This occurs because the handshake path canonicalizes IPv4-mapped IPv6 addresses to IPv4 before storing peers, while the mempool misbehavior path uses the raw IPv4-mapped IPv6 address. When a peer connects over IPv4 to a dual-stack listener and triggers a mempool misbehavior penalty, the address book lookup fails an assertion due to address format mismatch, causing a crash. The attacker only needs to complete a handshake and advertise an invalid transaction. The issue is patched in Zebra 4.5.0 by applying address canonicalization in the misbehavior update path. Workarounds include binding to IPv4-only addresses or setting net.ipv6.bindv6only=1 on Linux.

A remote unauthenticated attacker can cause any synced Zebra node running the default Linux dual-stack configuration to crash deterministically by sending a single invalid mempool transaction advertisement after completing a P2P handshake over IPv4. The crash occurs after a 30-second delay due to batch misbehavior processing. This can cause persistent downtime as the crash can be repeated after each restart. No special privileges, mining capability, RPC access, or funds are required to exploit this vulnerability.

An official fix is available in Zebra version 4.5.0, which canonicalizes addresses consistently in the mempool misbehavior update path to prevent the assertion failure. Until upgrading, users can mitigate by configuring Zebra to listen on an IPv4-only address (e.g., 0.0.0.0:8233) to avoid IPv4-mapped IPv6 addresses, or by setting the Linux kernel parameter net.ipv6.bindv6only=1 to disable dual-stack acceptance. These workarounds prevent the address mismatch that triggers the crash.