CVE-2026-24281

HIGH EPSS 22.2%
Published Mar 7, 20263mo ago · Modified Mar 10, 20263mo ago
7.4 CVSS 3.1
High
Find Similar
Published Mar 7, 2026 3mo ago
Last Modified Mar 10, 2026 3mo ago

Description

Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.

CVSS Details

Base Score
7.4
Exploitability
2.2
Impact
5.2
Vector string
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack Vector Network
Attack Complexity High
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability None

Threat Intelligence

EPSS Exploit Probability
22.2% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 2

CWE-295
CWE-350

Affected Products 2

VendorProductVersionRange
apachezookeeper*≥3.8.0  –  <3.8.6
apachezookeeper*≥3.9.0  –  <3.9.5

References 2

  • openwall.com http://www.openwall.com/lists/oss-security/2026/03/07/4
    Mailing ListThird Party Advisory
  • lists.apache.org https://lists.apache.org/thread/088ddsbrzhd5lxzbqf5n24yg0mwh9jt2
    Mailing ListVendor Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.