> CVE-2026-59969

« BACK_TO_HOME
PUBLISHED
2026-09-16 10:16
MODIFIED
2026-09-16 10:16
EPSS (Prob. Exploit)
0.33%
Top 75.5%
DATA SOURCES:
NVD 🔗 2026-09-16 CWE MITRE 🔗 2026-10-01 FIRST EPSS 🔗 2026-10-18 OSV 🔗 2026-10-19

> DESCRIPTION

Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted peer certificate whose SAN does not match the connected host. A malicious or misissued peer certificate can therefore join quorum traffic, participate in leader election, and enter replication flows. Users are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> WEAKNESSES

CWE-297

> CWE DETAILED DESCRIPTIONS

CWE-297: Improper Validation of Certificate with Host Mismatch - The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode

AFFECTED PACKAGES:
Unknown / Unknown
16 versions affected
ALIASES:
BIT-zookeeper-2026-59969

> HISTORIQUE DES MODIFICATIONS

Première apparition
16/09/2026 10:16
Source: NVD
📊 ENRICHISSEMENT 01/10/2026 06:01
CWE
Champ modifié: Description CWE
Ancienne valeur:
N/A
Nouvelle valeur:
CWE-297: Improper Validation of Certificate with Host Mismatch - The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actu...
Total des modifications: 1 Dernière mise à jour: 3 weeks ago

> REFERENCES

https://lists.apache.org/thread/qf9kwsgtgbgtvwls6f41281846xg0rss
« BACK_TO_HOME