CVE-2026-109364
MEDIUM
NVD
CVSS Score
5.3
Severity
MEDIUM
Published
Oct 12, 2026
Vendor
unknown
Description
Zebra 2.3.0 before 6.4.0 contains a protection mechanism failure that allows unauthenticated peers to evade bans because bans and misbehavior scores are keyed on exact IP addresses. Attackers can reconnect from fresh IPv6 addresses in their /64 allocation or flush the 20,000-entry FIFO ban list to restore access for banned peers.