Zebra 2.3.0 through 6.3.9 implements a ban system that records misbehavior scores and bans based on the exact IP address of a peer. Because the key is tied to the full IP, an attacker who is not authenticated can circumvent the ban by connecting from a new IPv6 address in the same /64 allocation or by triggering a flush of the 20,000‑entry FIFO ban list. Consequently, a banned peer can repeatedly re‑join the network, potentially disrupting honest participants and undermining trust in the network’s moderation controls.

The vulnerability affects all installations of the Zcash Foundation’s Zebra software running versions 2.3.0 up to, but not including, 6.4.0. No specific sub‑versions are listed, so any build in that range is considered vulnerable.

The CVSS score of 6.9 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited known exploitation. The likely attack vector is any network connection from an unauthenticated peer; an attacker can simply obtain a new IPv6 address or cause a ban list clear to regain access. The exploit does not require privileged local access or exploit code, making it straightforward for an external adversary who can connect to the network node.