CVE-2026-24281

Name of the Vulnerable Software and Affected Versions Apache ZooKeeper versions prior to 3.8.6 Apache ZooKeeper versions prior to 3.9.5

Description A flaw exists in the hostname verification process within Apache ZooKeeper’s ZKTrustManager. When IP Subject Alternative Name (SAN) validation fails, the system incorrectly falls back to reverse DNS (PTR) record lookup. This allows attackers who control or manipulate PTR records to potentially impersonate ZooKeeper servers or clients, even when presenting a certificate trusted by the ZKTrustManager. Successful exploitation requires the attacker to possess a certificate that is already trusted by the system, making the attack more complex.

Recommendations Upgrade to Apache ZooKeeper version 3.8.6. Upgrade to Apache ZooKeeper version 3.9.5.