It's code running on partially attacker-controlled inputs. It several times had vulnerabilities that allowed an attacker to trigger blocks for arbitrary IPs.

I remember there's a privEsc on old versions of fail2ban.

Sketchy parsers operating on untrusted, unstructured log data.

fail2ban is worse than useless.