CVE-2026-59969

Name of the Vulnerable Software and Affected Versions Apache ZooKeeper versions prior to 3.8.7 Apache ZooKeeper versions prior to 3.9.6

Description Quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted peer certificate whose Subject Alternative Name (SAN) does not match the connected host. This allows a malicious or misissued peer certificate to join quorum traffic, participate in leader election, and enter replication flows.

Recommendations Upgrade to version 3.8.7. Upgrade to version 3.9.6.