{"id":"CVE-2026-59969","aliases":["BIT-zookeeper-2026-59969","DEBIAN-CVE-2026-59969","EUVD-2026-80331","GHSA-4pv3-cr63-m4ph","GHSA-crhr-qqj8-rpxc","GHSA-r978-9m6m-6gm6","RHLW-2026-19f4511248f79d69","UBUNTU-CVE-2026-59969"],"status":"published","title":"Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode","description":"Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted peer certificate whose SAN does not match the connected host. A malicious or misissued peer certificate can therefore join quorum traffic, participate in leader election, and enter replication flows.\n\n\n\nUsers are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.0033,"percentile":0.26448,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-297"],"published":"2026-09-16T09:27:00Z","modified":"2026-11-10T08:43:12Z","fixes":[{"ecosystem":"Bitnami","package":"zookeeper","fixed_in":["3.8.7","3.9.6"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"zookeeper","fixed_in":["3.9.6-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"zookeeper","ranges":[{"type":"SEMVER","events":[{"introduced":"3.8.0"},{"fixed":"3.8.7"},{"introduced":"3.9.0"},{"fixed":"3.9.6"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.8.0-11","3.8.0-11+deb12u1","3.8.0-11+deb12u2","3.9.1-1","3.9.2-1","3.9.2-2","3.9.3-1","3.9.3-2","3.9.4-1","3.9.4-2","3.9.5-1","3.9.5-2","3.9.6-1"]},{"source":"osv","ecosystem":"Debian:13","package":"zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.9.3-1","3.9.3-1+deb13u1","3.9.3-2","3.9.4-1","3.9.4-2","3.9.5-1","3.9.5-2","3.9.6-1"]},{"source":"osv","ecosystem":"Debian:14","package":"zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.6-1"}]}],"versions":["3.9.3-1","3.9.3-2","3.9.4-1","3.9.4-2","3.9.5-1","3.9.5-2"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.apache.zookeeper:zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.3.rhlw-00015"}]}],"versions":["3.3.0","3.3.1","3.3.2","3.3.3","3.3.4","3.3.5","3.3.6","3.4.0","3.4.1","3.4.10","3.4.11","3.4.12","3.4.13","3.4.14","3.4.2","3.4.3","3.4.4","3.4.5","3.4.6","3.4.7","3.4.8","3.4.9","3.5.0-alpha","3.5.1-alpha","3.5.10","3.5.2-alpha","3.5.3-beta","3.5.4-beta","3.5.5","3.5.6","3.5.7","3.5.8","3.5.9","3.6.0","3.6.1","3.6.2","3.6.3","3.6.4","3.7.0","3.7.1","3.7.2","3.8.0","3.8.1","3.8.2","3.8.3"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.5+dfsg-1","3.4.5+dfsg-1ubuntu0.1~esm1","3.4.5+dfsg-1ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.6-8","3.4.7-1","3.4.8-1","3.4.8-1ubuntu0.1~esm1","3.4.8-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.10-2","3.4.10-3","3.4.13-3","3.4.13-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.13-1","3.4.13-3","3.4.13-3build1","3.4.13-4","3.4.13-5","3.4.13-5build1","3.4.13-5ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.13-5ubuntu4","3.4.13-6ubuntu2","3.4.13-6ubuntu3","3.4.13-6ubuntu4","3.4.13-6ubuntu4.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.8.0-11","3.9.1-1","3.9.1-1build1","3.9.1-1build2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.9.5-1","3.9.5-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.9.3-1build2","3.9.3-1build3","3.9.4-1","3.9.5-1"]}],"products":[{"vendor":"apache","product":"zookeeper"},{"vendor":"apache software foundation","product":"apache zookeeper"}],"references":[{"url":"https://lists.apache.org/thread/qf9kwsgtgbgtvwls6f41281846xg0rss","tags":["vendor-advisory","Mailing List","Vendor Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/15/4","tags":["Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59969","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-4pv3-cr63-m4ph"},{"url":"https://repo.maven.apache.org/maven2","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59969.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-59969","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23944.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/96s5nqssj03rznz9hv58txdb2k1lr79k","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23944","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-r978-9m6m-6gm6","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24308.json","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:10184","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:14272","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:14276","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34608","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8509","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-24308","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24308.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/qng3rtzv2pqkmko4rhv85jfplkyrgqdr","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24308","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-crhr-qqj8-rpxc","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59739.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/v0lrwsbdxvx6w67p3z7fxf3hzyncq55l","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59739","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/79xxx/CVE-2026-79993.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/9cw3rmrzhqpct26v8j18fy41bghlq8y5","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79993","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84439.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/b7qnjvqjh393l0j07tmnb5ggg40sx3m6","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84439","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84501.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/ohby1g6zjt72p0w79rhbr41nczzvr33y","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84501","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-59969","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59969","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-59969","title":"Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode","description":"Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted peer certificate whose SAN does not match the connected host. A malicious or misissued peer certificate can therefore join quorum traffic, participate in leader election, and enter replication flows.\n\n\n\nUsers are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.","status":"published","published":"2026-09-16T09:27:00.726Z","modified":"2026-09-17T19:17:01.444Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-297"],"updated_at":"2026-11-02T14:19:58.560602Z"}],"euvd":[{"id":"EUVD-2026-80331","description":"Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted peer certificate whose SAN does not match the connected host. A malicious or misissued peer certificate can therefore join quorum traffic, participate in leader election, and enter replication flows.\n\n\n\nUsers are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.","status":"published","published":"2026-09-16T09:27:00Z","modified":"2026-09-17T19:17:01Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T17:28:10.042182Z"}],"ghsa":[{"id":"GHSA-4pv3-cr63-m4ph","title":"Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments....","description":"Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted peer certificate whose SAN does not match the connected host. A malicious or misissued peer certificate can therefore join quorum traffic, participate in leader election, and enter replication flows.\n\n\n\nUsers are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.","status":"published","published":"2026-09-16T12:30:30Z","modified":"2026-09-17T21:31:36Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-297"],"updated_at":"2026-11-02T15:12:08.779152Z"}],"nvd":[{"id":"CVE-2026-59969","description":"Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted peer certificate whose SAN does not match the connected host. A malicious or misissued peer certificate can therefore join quorum traffic, participate in leader election, and enter replication flows.\n\n\n\nUsers are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.","status":"published","published":"2026-09-16T10:16:51.22Z","modified":"2026-09-18T14:31:23.357Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-297"],"updated_at":"2026-11-02T14:12:48.287983Z"}],"osv":[{"id":"CVE-2026-59969","title":"Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode","description":"Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted peer certificate whose SAN does not match the connected host. A malicious or misissued peer certificate can therefore join quorum traffic, participate in leader election, and enter replication flows.\n\n\n\nUsers are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.","status":"published","published":"2026-09-16T09:27:00.726Z","modified":"2026-10-28T02:30:50.182102282Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-297"],"updated_at":"2026-11-02T15:45:12.496548Z"},{"id":"DEBIAN-CVE-2026-59969","description":"Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted peer certificate whose SAN does not match the connected host. A malicious or misissued peer certificate can therefore join quorum traffic, participate in leader election, and enter replication flows.    Users are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.","status":"published","published":"2026-09-16T10:16:51.22Z","modified":"2026-10-01T03:03:29.247615796Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:57.932517Z"},{"id":"RHLW-2026-19f4511248f79d69","title":"Lightwell Security Advisory: zookeeper 3.8.3.rhlw-00015","description":"Red Hat Lightwell has released org.apache.zookeeper:zookeeper 3.8.3.rhlw-00015 with backported fixes for CVE-2024-23944, CVE-2026-24308, CVE-2026-59739, CVE-2026-59969, CVE-2026-79993, CVE-2026-84439, and CVE-2026-84501.\n\nCVE-2024-23944: Apache ZooKeeper: Information disclosure in persistent watcher handling\n\nCVE-2026-24308: Apache ZooKeeper: Sensitive information disclosure in client configuration handling\n\nCVE-2026-59739: Apache ZooKeeper: Information disclosure via SetWatches reconnect replay\n\nCVE-2026-59969: Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode\n\nCVE-2026-79993: Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znode\n\nCVE-2026-84439: Apache ZooKeeper: Audit log injection via unsanitized output from multiple sources\n\nCVE-2026-84501: Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProvider\n\nThis patched artifact is a drop-in replacement for org.apache.zookeeper:zookeeper 3.8.3 from Maven Central.","status":"published","published":"2026-11-09T00:50:22Z","modified":"2026-11-10T08:43:12.631396777Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-10T08:55:24.395105Z"},{"id":"UBUNTU-CVE-2026-59969","description":"Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted peer certificate whose SAN does not match the connected host. A malicious or misissued peer certificate can therefore join quorum traffic, participate in leader election, and enter replication flows. Users are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.","status":"published","published":"2026-09-16T10:16:00Z","modified":"2026-10-17T12:56:00.380692755Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:56:41.911783Z"},{"id":"BIT-zookeeper-2026-59969","title":"Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode","description":"Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted peer certificate whose SAN does not match the connected host. A malicious or misissued peer certificate can therefore join quorum traffic, participate in leader election, and enter replication flows.\n\n\n\nUsers are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.","status":"published","published":"2026-09-19T08:51:28.283Z","modified":"2026-09-19T09:15:03.071086663Z","updated_at":"2026-11-02T15:28:36.455807Z"}]}}