Zebra zebra-network ZLPP-5329 IPv4-Mapped Address Assertion Failure DoS

IPv4-Mapped Mempool Misbehavior Update Aborts Zebra Address Book Vulnerability Overview CVE ID: CVE-2025-5329 CVSS v3 base metrics: 7.5 / 10 Description: In Zebra network software, address normalization mismatch and mempool misbehavior update lead to assertion failures and process termination. Specifically, when a peer connects via IPv4 to a dual-stack IPv6 listener, it triggers a mempool misbehavior penalty, which in turn causes an assertion failure. Scope of Impact Affected versions: - (Rust): < 6.0.0 - (Rust): < 4.4.1 Fixed versions: - (Rust): 7.0.0 - (Rust): 4.5.0 Attack vector: Network Attack complexity: Low Privileges required: None User interaction: None Impact: High Mitigation Patch: In Zebra 4.5.0, the address normalization issue in the mempool misbehavior update path is fixed by applying via the new constructor. Workarounds: - Configure to use an IPv4-only address (e.g., ) to avoid IPv4-mapped IPv6 representations. - Alternatively, on Linux, set to prevent dual-stack acceptance. Detailed Information Trigger conditions: 1. Running version v4.4.1 or earlier. 2. The node runs on a Linux host with default address settings ( ). 3. The node is synchronized to the chain tip (expected production state). Attack steps: 1. A peer connects via IPv4 to the dual-stack IPv6 listener. 2. The mempool misbehavior penalty is triggered. 3. An assertion fails, causing the process to terminate. References CWE-617: Reachable Assertion CWE-843: Access of Resource Using Incompatible Type

Goal Reached Thanks to every supporter — we hit 100%!

Zebra zebra-network ZLPP-5329 IPv4-Mapped Address Assertion Failure DoS

More from this source