{"cve":"CVE-2026-24281","nvd":{"published":"2026-03-07T09:16:07.437","modified":"2026-07-15T02:18:48.563","status":"Modified","description":"Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","score":7.4},"cwes":["CWE-295","CWE-350"],"references":["https://lists.apache.org/thread/088ddsbrzhd5lxzbqf5n24yg0mwh9jt2","http://www.openwall.com/lists/oss-security/2026/03/07/4","https://access.redhat.com/errata/RHSA-2026:10184","https://access.redhat.com/errata/RHSA-2026:14272","https://access.redhat.com/errata/RHSA-2026:14276"],"products":["apache:zookeeper"],"source":"nvd","synced_at":"2026-10-19T22:25:53.701907451+00:00"},"epss":{"cve":"CVE-2026-24281","score":0.00645,"percentile":0.50917,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-7xrh-hqfc-g7qr","url":"https://osv.dev/vulnerability/GHSA-7xrh-hqfc-g7qr","summary":"Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager","modified":"2026-09-10T03:50:38.276709868Z","packages":[{"ecosystem":"Maven","name":"org.apache.zookeeper:zookeeper","purl":"pkg:maven/org.apache.zookeeper/zookeeper","ranges":[">=3.8.0 <3.8.6"],"fixed":["3.8.6"]},{"ecosystem":"Maven","name":"org.apache.zookeeper:zookeeper","purl":"pkg:maven/org.apache.zookeeper/zookeeper","ranges":[">=3.9.0 <3.9.5"],"fixed":["3.9.5"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}