CVE-2026-109364: Zebra 2.3.0 before 6.4.0 Peer Ban Bypass via Exact-IP Keying
Zebra 2.3.0 before 6.4.0 contains a protection mechanism failure that allows unauthenticated peers to evade bans because bans and misbehavior scores are keyed on exact IP addresses. Attackers can reconnect from fresh IPv6 addresses in their /64 allocation or flush the 20,000-entry FIFO ban list to restore access for banned peers.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to ban evasion?
Zebra versions from 2.3.0 before 6.4.0 are affected. Any deployment that relies on Zebra's peer bans or misbehavior scoring to exclude abusive unauthenticated network peers is exposed to this bypass.
What does an attacker need to bypass a ban?
No authentication or user interaction is required. An attacker can reconnect using fresh IPv6 addresses from a /64 allocation, causing each connection to be treated as a different exact-IP identity.
Can a banned peer regain access without changing its address?
Yes. An attacker may be able to flush Zebra's 20,000-entry FIFO ban list, which restores access for peers that were previously banned.