Zcash Zebra CVE-2026-109364

Requires a reachable Zebra node running 2.3.0 up to (not including) 6.4.0 with its default P2P peer-to-peer networking enabled; no authentication, no user interaction, and no non-default configuration are needed. Practical exploitation depends on the attacker either controlling an IPv6 /64 allocation (standard for most cloud/VPS tenants) to source fresh addresses, or being able to open enough connections to generate 20,000+ ban entries and roll the FIFO ban list. Limiting factors: the impact is confined to evading peer bans/misbehavior scoring - it does not grant code execution, data access, or direct node shutdown - and a node reachable only over IPv4 with no large address pool available to the attacker constrains the IPv6-rotation path.

This is a genuine but moderate-priority protection-mechanism failure (CWE-693), not a high-impact RCE. The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, low-complexity, unauthenticated reachability with no user interaction, which inflates exposure, but the impact is deliberately narrow: only VI:L (low integrity) with VC:N and VA:N, reflecting that the flaw degrades a defensive control (peer banning / misbehavior scoring) rather than directly compromising confidentiality or availability. The practical consequence is that banned or misbehaving P2P peers can re-enter the network - a building block for eclipse-style attacks, spam, or resource abuse against a node's networking stack - rather than a standalone critical outcome. No EPSS score, SSVC decision data, KEV listing, or POC indicator was provided in the input, so exploitation probability cannot be quantified from this dataset; by the precision rules this is 'no public exploit identified at time of analysis.' Signals are internally consistent (network vector matches a P2P ban-bypass described over IPv6/connection flooding), so there is no CVSS-vs-description conflict to flag - the main caveat is simply the absence of EPSS/KEV/POC telemetry, which limits confidence in real-world exploitation frequency.

An attacker runs a misbehaving peer against a public Zebra node and gets banned. Because bans are keyed to an exact IP, they reconnect from a different address within their IPv6 /64 allocation (trivial for most cloud/hosting tenants) or generate enough new ban entries to roll the 20,000-slot FIFO ban list and evict their own entry, restoring access. No public exploit code is identified in the provided data, but the technique requires no authentication and only commodity network resources.