{"id":"CVE-2026-24281","aliases":["BIT-zookeeper-2026-24281","DEBIAN-CVE-2026-24281","EUVD-2026-10139","GHSA-7xrh-hqfc-g7qr","RHLW-2026-3837a83be413601a","RHLW-2026-67695bc80de4b2e2","ROOT-APP-MAVEN-CVE-2026-24281","UBUNTU-CVE-2026-24281"],"status":"published","title":"Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager","description":"Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.00695,"percentile":0.53476,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295","CWE-297","CWE-350"],"published":"2026-03-07T08:50:32Z","modified":"2026-10-28T02:30:38Z","fixes":[{"ecosystem":"Maven","package":"org.apache.zookeeper:zookeeper","fixed_in":["3.8.6","3.9.5"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"zookeeper","fixed_in":["3.8.6","3.9.5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"zookeeper","fixed_in":["3.9.5-1"],"sources":["osv"]},{"ecosystem":"Red Hat Lightwell:Maven","package":"org.apache.zookeeper:zookeeper-jute","fixed_in":["3.8.3.rhlw-00003"],"sources":["osv"]},{"ecosystem":"Red Hat Lightwell:Maven","package":"org.apache.zookeeper:zookeeper","fixed_in":["3.8.3.rhlw-00003"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.apache.zookeeper:zookeeper","fixed_in":["3.9.3-root.io.2","3.9.2-root.io.1","3.9.2-root.io.2","3.8.4-root.io.2","3.9.3-root.io.3","3.9.2-root.io.3"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"org.apache.zookeeper:zookeeper","fixed_in":["3.9.3-aikido.3","3.9.2-aikido.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.zookeeper:zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.8.0"},{"fixed":"3.8.6"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.zookeeper:zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.9.0"},{"fixed":"3.9.5"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"zookeeper","ranges":[{"type":"SEMVER","events":[{"introduced":"3.8.0"},{"fixed":"3.8.6"},{"introduced":"3.9.0"},{"fixed":"3.9.5"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.8.0-11","3.8.0-11+deb12u1","3.8.0-11+deb12u2","3.9.1-1","3.9.2-1","3.9.2-2","3.9.3-1","3.9.3-2","3.9.4-1","3.9.4-2","3.9.5-1","3.9.5-2","3.9.6-1"]},{"source":"osv","ecosystem":"Debian:13","package":"zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.9.3-1","3.9.3-1+deb13u1","3.9.3-2","3.9.4-1","3.9.4-2","3.9.5-1","3.9.5-2","3.9.6-1"]},{"source":"osv","ecosystem":"Debian:14","package":"zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.5-1"}]}],"versions":["3.9.3-1","3.9.3-2","3.9.4-1","3.9.4-2"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.zookeeper:zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.8.0"},{"fixed":"3.8.6"}]}],"versions":["3.8.0","3.8.1","3.8.2","3.8.3","3.8.4","3.8.5"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.zookeeper:zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.9.0"},{"fixed":"3.9.5"}]}],"versions":["3.9.0","3.9.1","3.9.2","3.9.3","3.9.4"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.apache.zookeeper:zookeeper-jute","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.3.rhlw-00003"}]}],"versions":["3.5.10","3.5.5","3.5.6","3.5.7","3.5.8","3.5.9","3.6.0","3.6.1","3.6.2","3.6.3","3.6.4","3.7.0","3.7.1","3.7.2","3.8.0","3.8.1","3.8.2","3.8.3"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.apache.zookeeper:zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.3.rhlw-00003"}]}],"versions":["3.3.0","3.3.1","3.3.2","3.3.3","3.3.4","3.3.5","3.3.6","3.4.0","3.4.1","3.4.10","3.4.11","3.4.12","3.4.13","3.4.14","3.4.2","3.4.3","3.4.4","3.4.5","3.4.6","3.4.7","3.4.8","3.4.9","3.5.0-alpha","3.5.1-alpha","3.5.10","3.5.2-alpha","3.5.3-beta","3.5.4-beta","3.5.5","3.5.6","3.5.7","3.5.8","3.5.9","3.6.0","3.6.1","3.6.2","3.6.3","3.6.4","3.7.0","3.7.1","3.7.2","3.8.0","3.8.1","3.8.2","3.8.3"]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.apache.zookeeper:zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-root.io.2"},{"fixed":"3.9.2-root.io.1"},{"fixed":"3.9.2-root.io.2"},{"fixed":"3.8.4-root.io.2"},{"fixed":"3.9.3-root.io.3"},{"fixed":"3.9.2-root.io.3"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"org.apache.zookeeper:zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-aikido.3"},{"fixed":"3.9.2-aikido.3"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.5+dfsg-1","3.4.5+dfsg-1ubuntu0.1~esm1","3.4.5+dfsg-1ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.6-8","3.4.7-1","3.4.8-1","3.4.8-1ubuntu0.1~esm1","3.4.8-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.10-2","3.4.10-3","3.4.13-3","3.4.13-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.13-1","3.4.13-3","3.4.13-3build1","3.4.13-4","3.4.13-5","3.4.13-5build1","3.4.13-5ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.13-5ubuntu4","3.4.13-6ubuntu2","3.4.13-6ubuntu3","3.4.13-6ubuntu4","3.4.13-6ubuntu4.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.8.0-11","3.9.1-1","3.9.1-1build1","3.9.1-1build2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.9.3-1build1","3.9.3-1build2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.9.5-1","3.9.5-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.9.3-1build2","3.9.3-1build3","3.9.4-1","3.9.5-1"]}],"products":[{"vendor":"apache","product":"zookeeper"},{"vendor":"apache software foundation","product":"apache zookeeper"},{"vendor":"red hat","product":"red hat amq broker 7.12.7"},{"vendor":"red hat","product":"red hat amq broker 7.13.5"},{"vendor":"red hat","product":"red hat amq broker 7.14.0"},{"vendor":"red hat","product":"red hat build of apache camel for spring boot 4"},{"vendor":"red hat","product":"red hat build of debezium 2"},{"vendor":"red hat","product":"red hat build of debezium 3"},{"vendor":"red hat","product":"red hat data grid 8"},{"vendor":"red hat","product":"red hat fuse 7"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 7"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 8"},{"vendor":"red hat","product":"red hat jboss enterprise application platform expansion pack"},{"vendor":"red hat","product":"red hat offline knowledge portal"},{"vendor":"red hat","product":"red hat openshift ai (rhoai)"},{"vendor":"red hat","product":"red hat openshift ai 2.25"},{"vendor":"red hat","product":"streams for apache kafka 2.9.4"},{"vendor":"red hat","product":"streams for apache kafka 3"}],"references":[{"url":"https://lists.apache.org/thread/088ddsbrzhd5lxzbqf5n24yg0mwh9jt2","tags":["vendor-advisory","Mailing List","Vendor Advisory","advisory","web","report"]},{"url":"http://www.openwall.com/lists/oss-security/2026/03/07/4","tags":["Mailing List","Third Party Advisory","advisory","web","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-24281","tags":["vdb-entry","x_refsource_REDHAT","web","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445449","tags":["issue-tracking","x_refsource_REDHAT","web","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24281.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:14276","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:14272","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8509","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:10184","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34608","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24281","tags":["web","advisory"]},{"url":"https://github.com/apache/zookeeper/commit/66c4efecdda1302d9cfb3af9eedb122b74452bf3","tags":["web"]},{"url":"https://issues.apache.org/jira/browse/ZOOKEEPER-4986","tags":["web"]},{"url":"https://github.com/advisories/GHSA-7xrh-hqfc-g7qr","tags":["advisory"]},{"url":"https://repo.maven.apache.org/maven2","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24281.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-24281","tags":["advisory"]},{"url":"https://github.com/apache/zookeeper","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-24281","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-24281","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-24281","title":"Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager","description":"Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.","status":"published","published":"2026-03-07T08:50:32.525Z","modified":"2026-07-15T01:17:24.357Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"adp"},{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-350","CWE-295","CWE-295"],"updated_at":"2026-11-02T14:19:50.24628Z"}],"euvd":[{"id":"EUVD-2026-10139","description":"Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.","status":"published","published":"2026-03-07T08:50:32Z","modified":"2026-07-15T01:17:24Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T18:19:55.318488Z"}],"ghsa":[{"id":"GHSA-7xrh-hqfc-g7qr","title":"Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager","description":"Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.","status":"published","published":"2026-03-07T09:30:15Z","modified":"2026-03-10T19:32:54Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-295","CWE-297"],"updated_at":"2026-11-02T14:39:33.538417Z"}],"nvd":[{"id":"CVE-2026-24281","description":"Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.","status":"published","published":"2026-03-07T09:16:07.437Z","modified":"2026-07-15T02:18:48.563Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"primary"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-295","CWE-350"],"updated_at":"2026-11-02T14:12:08.279852Z"}],"osv":[{"id":"CVE-2026-24281","title":"Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager","description":"Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.","status":"published","published":"2026-03-07T08:50:32.525Z","modified":"2026-10-28T02:30:38.189756199Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-295","CWE-350"],"updated_at":"2026-11-02T15:44:59.079784Z"},{"id":"DEBIAN-CVE-2026-24281","description":"Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.","status":"published","published":"2026-03-07T09:16:07.437Z","modified":"2026-10-01T03:02:32.818808821Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:53.877573Z"},{"id":"GHSA-7xrh-hqfc-g7qr","title":"Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager","description":"Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.","status":"published","published":"2026-03-07T09:30:15Z","modified":"2026-09-10T03:50:38.276709868Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-295","CWE-297"],"updated_at":"2026-11-02T15:46:41.732368Z"},{"id":"RHLW-2026-3837a83be413601a","title":"Lightwell Security Advisory: zookeeper-jute 3.8.3.rhlw-00003","description":"Red Hat Lightwell has released org.apache.zookeeper:zookeeper-jute 3.8.3.rhlw-00003 with a backported security fix.\n\nCVE-2026-24281: Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager\n\nThis patched artifact is a drop-in replacement for org.apache.zookeeper:zookeeper-jute 3.8.3 from Maven Central.","status":"published","published":"2026-10-08T19:46:03Z","modified":"2026-10-27T04:00:03.593099922Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-67695bc80de4b2e2","title":"Lightwell Security Advisory: zookeeper 3.8.3.rhlw-00003","description":"Red Hat Lightwell has released org.apache.zookeeper:zookeeper 3.8.3.rhlw-00003 with a backported security fix.\n\nCVE-2026-24281: Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager\n\nThis patched artifact is a drop-in replacement for org.apache.zookeeper:zookeeper 3.8.3 from Maven Central.","status":"published","published":"2026-09-10T12:06:19Z","modified":"2026-10-27T04:00:08.782755807Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"ROOT-APP-MAVEN-CVE-2026-24281","title":"CVE-2026-24281 in io.root.org.apache.zookeeper:zookeeper - Patched by Root","description":"Root has patched CVE-2026-24281 in the io.root.org.apache.zookeeper:zookeeper package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-06-17T15:49:12Z","modified":"2026-06-17T18:15:31.011581318Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:27.066589Z"},{"id":"UBUNTU-CVE-2026-24281","description":"Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.","status":"published","published":"2026-03-07T09:16:00Z","modified":"2026-10-17T12:59:56.126450234Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"},{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:08.726452Z"},{"id":"BIT-zookeeper-2026-24281","title":"Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager","description":"Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.","status":"published","published":"2026-03-10T08:52:16.699Z","modified":"2026-09-08T08:46:16.970383527Z","updated_at":"2026-11-02T15:28:36.455807Z"}]}}