Vulnerability details
CVE-2026-24281
Apache Software Foundation Apache ZooKeeperRed Hat Fuse 7Red Hat JBoss Enterprise Application Platform Expansion PackRed Hat Offline Knowledge PortalRed Hat OpenShift AIRed Hat build of Debezium 2
Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager
CVSS 3.1
7.4High
Official description
Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 5.9Medium | 3.1 | CISA ADP / Vulnrichment (CISA-ADP) | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N |
| 7.4High | 3.1 | CVEProject cvelistV5 (CNA) (redhat-SADP) | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Apache Software Foundation | Apache ZooKeeper | 3.8.0 ≤ v ≤ 3.8.5 | CVEProject cvelistV5 (CNA) |
| Apache Software Foundation | Apache ZooKeeper | 3.9.0 ≤ v ≤ 3.9.4 | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Fuse 7 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Offline Knowledge Portal | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat build of Debezium 2 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat build of Debezium 3 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | streams for Apache Kafka 3 | All | CVEProject cvelistV5 (CNA) |
References and advisories
10- https://lists.apache.org/thread/088ddsbrzhd5lxzbqf5n24yg0mwh9jt2 vendor-advisory
- http://www.openwall.com/lists/oss-security/2026/03/07/4
- https://access.redhat.com/security/cve/CVE-2026-24281 vdb-entryx_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2445449 issue-trackingx_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24281.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:14276 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:14272 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8509 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:10184 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:34608 vendor-advisoryx_refsource_REDHAT
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-03-07
- Last updated
- 2026-07-15
- State
- Published
- Assigner (CNA)
- apache
Exploit prediction (EPSS)
0.69%
Probability of exploitation in 30 days
53.1%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-350Reliance on Reverse DNS Resolution for a Security-Critical Action
- CWE-295Improper Certificate Validation