CVE-2026-24281
Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager
Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.
- Record
CVE-2026-24281- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-295, CWE-350
- Updated
- 2026-11-02
CVE List
Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager
Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.
- Record
CVE-2026-24281- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-350, CWE-295, CWE-295
- Updated
- 2026-11-02
EUVDEUVD-2026-10139
Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.
- Record
EUVD-2026-10139- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-7xrh-hqfc-g7qr
Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager
Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.
- Record
GHSA-7xrh-hqfc-g7qr- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-295, CWE-297
- Updated
- 2026-11-02
OSV
Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager
Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.
- Record
CVE-2026-24281- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-295, CWE-350
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-24281
Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.
- Record
DEBIAN-CVE-2026-24281- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
Show 6 moreShow less
OSVGHSA-7xrh-hqfc-g7qr
Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager
Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.
- Record
GHSA-7xrh-hqfc-g7qr- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-295, CWE-297
- Updated
- 2026-11-02
OSVRHLW-2026-3837a83be413601a
Lightwell Security Advisory: zookeeper-jute 3.8.3.rhlw-00003
Red Hat Lightwell has released org.apache.zookeeper:zookeeper-jute 3.8.3.rhlw-00003 with a backported security fix.
CVE-2026-24281: Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager
This patched artifact is a drop-in replacement for org.apache.zookeeper:zookeeper-jute 3.8.3 from Maven Central.
- Record
RHLW-2026-3837a83be413601a- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVRHLW-2026-67695bc80de4b2e2
Lightwell Security Advisory: zookeeper 3.8.3.rhlw-00003
Red Hat Lightwell has released org.apache.zookeeper:zookeeper 3.8.3.rhlw-00003 with a backported security fix.
CVE-2026-24281: Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager
This patched artifact is a drop-in replacement for org.apache.zookeeper:zookeeper 3.8.3 from Maven Central.
- Record
RHLW-2026-67695bc80de4b2e2- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVROOT-APP-MAVEN-CVE-2026-24281
CVE-2026-24281 in io.root.org.apache.zookeeper:zookeeper - Patched by Root
Root has patched CVE-2026-24281 in the io.root.org.apache.zookeeper:zookeeper package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2026-24281- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-24281
Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.
- Record
UBUNTU-CVE-2026-24281- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVBIT-zookeeper-2026-24281 No score
Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager
Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.
- Record
BIT-zookeeper-2026-24281- Updated
- 2026-11-02
Affected products
- apache zookeeper
- apache software foundation zookeeper
- red hat amq broker 7.12.7
- red hat amq broker 7.13.5
- red hat amq broker 7.14.0
- red hat build of apache camel for spring boot 4
- red hat build of debezium 2
- red hat build of debezium 3
- red hat data grid 8
- red hat fuse 7
- red hat jboss enterprise application platform 7
- red hat jboss enterprise application platform 8
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.zookeeper:zookeeperMaven |
3.8.0 up to 3.8.6 | 3.8.6 |
org.apache.zookeeper:zookeeperMaven |
3.9.0 up to 3.9.5 | 3.9.5 |
zookeeperBitnami |
3.8.0 up to 3.8.6, 3.9.0 up to 3.9.5 | 3.8.63.9.5 |
zookeeperDebian:12 |
All versions, plus listed versions 3.8.0-113.8.0-11+deb12u13.8.0-11+deb12u23.9.1-13.9.2-1 Show 8 moreShow less3.9.2-23.9.3-13.9.3-23.9.4-13.9.4-23.9.5-13.9.5-23.9.6-1 |
None known |
zookeeperDebian:13 |
All versions, plus listed versions 3.9.3-13.9.3-1+deb13u13.9.3-23.9.4-13.9.4-23.9.5-13.9.5-23.9.6-1 |
None known |
zookeeperDebian:14 |
before 3.9.5-1, plus listed versions 3.9.3-13.9.3-23.9.4-13.9.4-2 |
3.9.5-1 |
org.apache.zookeeper:zookeeperMaven |
3.8.0 up to 3.8.6, plus listed versions 3.8.13.8.23.8.33.8.43.8.5 |
3.8.6 |
org.apache.zookeeper:zookeeperMaven |
3.9.0 up to 3.9.5, plus listed versions 3.9.13.9.23.9.33.9.4 |
3.9.5 |
org.apache.zookeeper:zookeeper-juteRed Hat Lightwell:Maven |
before 3.8.3.rhlw-00003, plus listed versions 3.5.103.5.53.5.63.5.73.5.8 Show 13 moreShow less3.5.93.6.03.6.13.6.23.6.33.6.43.7.03.7.13.7.23.8.03.8.13.8.23.8.3 |
3.8.3.rhlw-00003 |
org.apache.zookeeper:zookeeperRed Hat Lightwell:Maven |
before 3.8.3.rhlw-00003, plus listed versions 3.3.03.3.13.3.23.3.33.3.4 Show 40 moreShow less3.3.53.3.63.4.03.4.13.4.103.4.113.4.123.4.133.4.143.4.23.4.33.4.43.4.53.4.63.4.73.4.83.4.93.5.0-alpha3.5.1-alpha3.5.103.5.2-alpha3.5.3-beta3.5.4-beta3.5.53.5.63.5.73.5.83.5.93.6.03.6.13.6.23.6.33.6.43.7.03.7.13.7.23.8.03.8.13.8.23.8.3 |
3.8.3.rhlw-00003 |
Show 11 moreShow less
| Package | Affected | Fixed |
|---|---|---|
io.root.org.apache.zookeeper:zookeeperRoot:Maven |
before 3.9.3-root.io.2 | 3.9.3-root.io.23.9.2-root.io.13.9.2-root.io.23.8.4-root.io.23.9.3-root.io.33.9.2-root.io.3 |
org.apache.zookeeper:zookeeperRoot:Maven |
before 3.9.3-aikido.3 | 3.9.3-aikido.33.9.2-aikido.3 |
zookeeperUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 3.4.5+dfsg-13.4.5+dfsg-1ubuntu0.1~esm13.4.5+dfsg-1ubuntu0.1~esm3 |
None known |
zookeeperUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 3.4.6-83.4.7-13.4.8-13.4.8-1ubuntu0.1~esm13.4.8-1ubuntu0.1~esm2 |
None known |
zookeeperUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 3.4.10-23.4.10-33.4.13-33.4.13-3ubuntu0.1~esm1 |
None known |
zookeeperUbuntu:20.04:LTS |
All versions, plus listed versions 3.4.13-13.4.13-33.4.13-3build13.4.13-43.4.13-53.4.13-5build13.4.13-5ubuntu0.1 |
None known |
zookeeperUbuntu:22.04:LTS |
All versions, plus listed versions 3.4.13-5ubuntu43.4.13-6ubuntu23.4.13-6ubuntu33.4.13-6ubuntu43.4.13-6ubuntu4.1 |
None known |
zookeeperUbuntu:24.04:LTS |
All versions, plus listed versions 3.8.0-113.9.1-13.9.1-1build13.9.1-1build2 |
None known |
zookeeperUbuntu:25.10 |
All versions, plus listed versions 3.9.3-1build13.9.3-1build2 |
None known |
zookeeperUbuntu:26.10 |
All versions, plus listed versions 3.9.5-13.9.5-2 |
None known |
zookeeperUbuntu:26.04:LTS |
All versions, plus listed versions 3.9.3-1build23.9.3-1build33.9.4-13.9.5-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-24281 is a high vulnerability (CVSS 7.4) in Apache Zookeeper, published March 7, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.69%, the 53rd percentile. Fixed in org.apache.zookeeper:zookeeper 3.8.6.
References
lists.apache.org/thread/088ddsbrzhd5lxzbqf5n24yg0mwh9jt2
openwall.com/lists/oss-security/2026/03/07/4
access.redhat.com/security/cve/CVE-2026-24281
bugzilla.redhat.com/show_bug.cgi?id=2445449
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24281.json
Show 14 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-24281
github.com/apache/zookeeper/commit/66c4efecdda1302d9cfb3af9eedb122b74452bf3
issues.apache.org/jira/browse/ZOOKEEPER-4986
repo.maven.apache.org/maven2
security-tracker.debian.org/tracker/CVE-2026-24281
ubuntu.com/security/CVE-2026-24281
cve.org/CVERecord?id=CVE-2026-24281