CVE-2026-52829

Name of the Vulnerable Software and Affected Versions ZEBRA versions prior to 4.5.0

Description An address normalization mismatch between the handshake path and the mempool misbehavior path allows an unauthenticated IPv4 peer to deterministically crash a synced Zebra node. This occurs when a node uses the default Linux dual-stack listener configuration, where IPv4 connections are represented as IPv4-mapped IPv6 socket addresses. While the handshake path canonicalizes these addresses to plain IPv4 via MetaAddr::new connected, the mempool misbehavior path forwards the raw transient address to MetaAddrChange::UpdateMisbehavior without canonicalization. When the apply to meta addr function compares the canonical address-book entry with the raw update address, an address mismatch assertion is triggered, leading to a process abort. An attacker can trigger this by completing a P2P handshake and advertising an invalid mempool transaction.

Recommendations Update ZEBRA to version 4.5.0. As a temporary workaround, configure listen addr to an IPv4-only address (e.g., 0.0.0.0:8233). As a temporary workaround, set net.ipv6.bindv6only=1 on Linux to prevent dual-stack acceptance.