# CVE-2026-109364: Zebra peer ban bypass via exact IP keying

Source: https://junglewise.ai/threats/cve-2026-109364-zebra-2-3-0-before-6-4-0-contains-a-protection-mechanism-failure  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-109364 · Severity: medium · CVSS 5.3 · Published 2026-10-12

Zebra is a blockchain node implementation for the Zcash network. An unauthenticated attacker can circumvent the peer ban mechanism by reconnecting from different IPv6 addresses within their allocated range, or by flushing the ban list with a large number of connections, allowing previously banned peers to regain access. This undermines the node's ability to protect itself from abusive peers and denial-of-service attacks.

Technologies: [Zcash Foundation Zebra](https://junglewise.ai/threats/technologies/zebra). Vendors: [Zcash Foundation](https://junglewise.ai/threats/vendors/zcash-foundation).

## Quick answers

**Is CVE-2026-109364 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-109364 being exploited in the wild.

**How severe is CVE-2026-109364?** Medium severity, with a CVSS score of 5.3, published 12 October 2026.

**Which products and versions are affected?** Zcash Foundation Zebra 2.3.0 before 6.4.0.

**Is there a fix for CVE-2026-109364?** Yes: fixed in 6.4.2. Until then: Operators can block abusive IPv6 ranges at the firewall level. The unreleased peer connection grouping from PR #11256 limits concurrent connections per /64 allocation but does not restore ban persistence until the full fix is deployed. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-109364 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-109364?** Check whether you run Zcash Foundation Zebra at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 6.4.2

Operators can block abusive IPv6 ranges at the firewall level. The unreleased peer connection grouping from PR #11256 limits concurrent connections per /64 allocation but does not restore ban persistence until the full fix is deployed.

## Technical details

The vulnerability is a protection mechanism failure (CWE-693) where peer bans are keyed on exact IP addresses rather than IPv6 /64 subnets. An attacker with a standard IPv6 /64 allocation can reconnect from fresh addresses with zero misbehavior score, bypassing persistent bans. Additionally, since the 20,000-entry ban list uses FIFO eviction, an attacker can flood it with violations from throwaway addresses to clear bans on unrelated peers. The patch groups connection limits and bans by /64 subnet rather than exact address.

## Affected products

- Zcash Foundation Zebra 2.3.0 before 6.4.0

## Timeline

- 2026-09-28: disclosed
- 2026-10-12: advisory

## References

- [https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-jhpp-8h75-7pv5](https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-jhpp-8h75-7pv5)
- [https://www.vulncheck.com/advisories/zebra-2.3.0-before-6.4.0-peer-ban-bypass-via-exact-ip-keying](https://www.vulncheck.com/advisories/zebra-2.3.0-before-6.4.0-peer-ban-bypass-via-exact-ip-keying)

## Related threats

- [Zebra incomplete cleanup in checkpoint sync stalls initial sync](https://junglewise.ai/threats/cve-2026-123560-zebra-before-7-0-0-contains-an-incomplete-cleanup-vulnerability)
- [Zebra denial of service via quadratic sighash computation](https://junglewise.ai/threats/cve-2026-123559-zebra-before-7-0-0-contains-an-inefficient-algorithmic)
- [Zcash Foundation Zebra zebrad reachable assertion denial of service](https://junglewise.ai/threats/cve-2026-123557-zcashfoundation-zebra-zebrad-before-7-0-0-contains-a-reachable)
- [Zcash Foundation Zebra protection mechanism failure in mempool lock-time scoring](https://junglewise.ai/threats/cve-2026-123556-zcashfoundation-zebra-from-4-5-0-before-7-0-0-contains-a)
- [Zebra misbehavior scoring bypass via invalid script verification](https://junglewise.ai/threats/cve-2026-123555-zebra-from-2-3-0-before-7-0-0-contains-a-denial-of-service)