> CVE-2026-24281

« BACK_TO_HOME
PUBLISHED
2026-03-07 09:16
MODIFIED
2026-03-07 09:16
EPSS (Prob. Exploit)
0.65%
Top 49.7%
DATA SOURCES:
NVD 🔗 2026-03-07 CWE MITRE 🔗 2026-11-01 FIRST EPSS 🔗 2026-10-25 GITHUB 🔗 2026-10-28

> DESCRIPTION

Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> WEAKNESSES

CWE-295 CWE-350

> CWE DETAILED DESCRIPTIONS

CWE-295: Improper Certificate Validation - The product does not validate, or incorrectly validates, a certificate. | CWE-350: Reliance on Reverse DNS Resolution for a Security-Critical Action - The product performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.

> RED HAT SECURITY ADVISORIES

Red Hat Security Advisory: Red Hat AMQ Broker 7.14.0 release and security update
Red Hat AMQ Broker 7.14.0 is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring Sy...
Red Hat Security Advisory: RHOAI 2.25.5 - Red Hat OpenShift AI
Updated images are now available for Red Hat OpenShift AI.
Red Hat Security Advisory: Red Hat AMQ Broker 7.12.7 release and security update
Red Hat AMQ Broker 7.12.7 is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring Sy...
Red Hat Security Advisory: Red Hat AMQ Broker 7.13.5 release and security update
Red Hat AMQ Broker 7.13.5 is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring Sy...
Red Hat Security Advisory: Streams for Apache Kafka 2.9.4 release and security update
Streams for Apache Kafka 2.9.4 is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scorin...
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.8 XP 6.0.6.GA release
JBoss EAP XP 6.0.6.GA release on the EAP 8.1 base. See references for release notes.

> GITHUB SECURITY ADVISORY

GHSA-7xrh-hqfc-g7qr HIGH

Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager

AFFECTED PACKAGES:
MAVEN / org.apache.zookeeper:zookeeper
>= 3.9.0, < 3.9.5
Fixed in: 3.9.5
MAVEN / org.apache.zookeeper:zookeeper
>= 3.8.0, < 3.8.6
Fixed in: 3.8.6

> HISTORIQUE DES MODIFICATIONS

Première apparition
07/03/2026 09:16
Source: NVD
📊 ENRICHISSEMENT 01/04/2026 06:02
CWE
Champ modifié: Description CWE
Ancienne valeur:
N/A
Nouvelle valeur:
CWE-295: Improper Certificate Validation - The product does not validate, or incorrectly validates, a certificate. | CWE-350: Reliance on Reverse DNS Resolution for a Security-Critical Action - The pr...
Total des modifications: 1 Dernière mise à jour: 7 months ago

> REFERENCES

https://lists.apache.org/thread/088ddsbrzhd5lxzbqf5n24yg0mwh9jt2
« BACK_TO_HOME