CVE-2026-109364 — Zebra 2.3.0 before 6.4.0 Peer Ban Bypass via Exact-IP Keying
Zebra 2.3.0 before 6.4.0 contains a protection mechanism failure that allows unauthenticated peers to evade bans because bans and misbehavior scores are keyed on exact IP addres…
Published: 2026-10-12 · CVSS: 6.9 · CVSS 4.0
Zebra 2.3.0 before 6.4.0 contains a protection mechanism failure that allows unauthenticated peers to evade bans because bans and misbehavior scores are keyed on exact IP addresses. Attackers can reconnect from fresh IPv6 addresses in their /64 allocation or flush the 20,000-entry FIFO ban list to restore access for banned peers.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7