Read the docs
TI-2026-19568 Aliases CVE-2026-24281GHSA-7xrh-hqfc-g7qr

Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager

Priority LOW 34CWE-295Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Spoofing
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 6 fixed, 7 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-295.

Summary

Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00695 53rd percentileScored 2026-11-07
Fix Partial org.apache.zookeeper:zookeeper (Maven): 3.8.6, 3.9.5Red Hat: 6 advisoriesRed Hat: 6 fixed, 7 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache ZooKeeper3.9.0 – 3.9.4; 3.8.0 – 3.8.5—No fix listedCNA
—org.apache.zookeeper:zookeeper (Maven)3.8.0 to before 3.8.63.8.6Patch availableGHSA-7xrh-hqfc-g7qr
—org.apache.zookeeper:zookeeper (Maven)3.9.0 to before 3.9.53.9.5Patch availableGHSA-7xrh-hqfc-g7qr
  • Apache ZooKeeper VendorApache Affected 3.9.0 – 3.9.4; 3.8.0 – 3.8.5 Fixed in — No fix listed CNA
  • org.apache.zookeeper:zookeeper (Maven) Vendor— Affected 3.8.0 to before 3.8.6 Fixed in 3.8.6 Patch available GHSA-7xrh-hqfc-g7qr
  • org.apache.zookeeper:zookeeper (Maven) Vendor— Affected 3.9.0 to before 3.9.5 Fixed in 3.9.5 Patch available GHSA-7xrh-hqfc-g7qr

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:zookeeper:*:*:*:*:*:*:*:*3.8.0 to before 3.8.6; 3.9.0 to before 3.9.5VulnerableApache
  • cpe:2.3:a:apache:zookeeper:*:*:*:*:*:*:*:* Versions 3.8.0 to before 3.8.6; 3.9.0 to before 3.9.5 Vulnerable ·Apache

Remediation

  • Fix · GHSA-7xrh-hqfc-g7qr org.apache.zookeeper:zookeeper (Maven) Fixed in 3.8.6 Advisory →
  • Fix · GHSA-7xrh-hqfc-g7qr org.apache.zookeeper:zookeeper (Maven) Fixed in 3.9.5 Advisory →

Red Hat 6 advisories

  • RHSA-2026:34608 Released 2026-07-02 · Red Hat rating Important
    Streams for Apache Kafka 2.9.4 release and security update
    • Streams for Apache Kafka 2.9.4
  • RHSA-2026:19678 Released 2026-05-20 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.6 XP 6.0.4.GA security release
    • Red Hat JBoss Enterprise Application Platform 6.0.4.GA io.netty.netty-codec-http2-4.1.132.Final-redhat-00001.jar, org.apache.zookeeper.zookeeper-3.8.6.redhat-00001.jar
  • RHSA-2026:14276 Released 2026-05-06 · Red Hat rating Important
    Red Hat AMQ Broker 7.12.7 release and security update
    • Red Hat AMQ Broker 7.12.7
Show 3 more Red Hat advisories
  • RHSA-2026:14272 Released 2026-05-06 · Red Hat rating Important
    Red Hat AMQ Broker 7.13.5 release and security update
    • Red Hat AMQ Broker 7.13.5
  • RHSA-2026:10184 Released 2026-04-23 · Red Hat rating Important
    RHOAI 2.25.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
  • RHSA-2026:8509 Released 2026-04-16 · Red Hat rating Important
    Red Hat AMQ Broker 7.14.0 release and security update
    • Red Hat AMQ Broker 7.14.0

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform Expansion PackAffectedNo fix yet
Red Hat Offline Knowledge PortalAffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat build of Debezium 2AffectedNo fix planned: Will not fix
Red Hat build of Debezium 3AffectedNo fix planned: Will not fix
streams for Apache Kafka 3AffectedNo fix planned: Will not fix
Red Hat AMQ Broker 7.12.7Fixed RHSA-2026:14276
Red Hat AMQ Broker 7.13.5Fixed RHSA-2026:14272
Red Hat AMQ Broker 7.14.0Fixed RHSA-2026:8509
Red Hat JBoss Enterprise Application Platform 6.0.4.GAFixed RHSA-2026:19678
Red Hat OpenShift AI 2.25Fixed RHSA-2026:10184
Streams for Apache Kafka 2.9.4Fixed RHSA-2026:34608
Not affected: 6 products
  • Red Hat Data Grid 8
  • Red Hat JBoss Enterprise Application Platform 6.0.4.GA
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat OpenShift AI 2.25
  • Red Hat build of Apache Camel for Spring Boot 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-24281
  2. 2026-10-03 Alias added: GHSA-7xrh-hqfc-g7qr
  3. 2026-10-09 Fix available: RHSA-2026:8509 · Red Hat
  4. 2026-10-09 Fix available: RHSA-2026:14272 · Red Hat
  5. 2026-10-10 Fix available: RHSA-2026:19678 · Red Hat
  6. 2026-10-10 Fix available: Red Hat AMQ Broker 7.13.5, Red Hat AMQ Broker 7.14.0, Red Hat JBoss Enterprise Application Platform 6.0.4.GA · Red Hat
  7. 2026-10-20 Affected versions changed · Red Hat
  8. 2026-10-21 EPSS moved to the 50th–90th percentile

References

Advisory 3

Other 3

  • TI-2017-03638 Missing authentication in Apache ZooKeeper CVSS 3.0HIGH 7.5
  • TI-2023-24043 Apache ZooKeeper: Authorization bypass in SASL Quorum Peer Authentication CVSS 3.1CRITICAL 9.1
  • TI-2021-04395 Possible request smuggling in HTTP/2 due missing validation CVSS 3.1MEDIUM 5.9
  • TI-2024-34425 Apache ZooKeeper: Authentication bypass with IP-based authentication in Admin Server CVSS 3.1CRITICAL 9.1
  • TI-2016-04336 Buffer overflow in the C cli shell in Apache Zookeeper before 3.4.9 and 3.5.x before… CVSS 3.0HIGH 8.1
  • TI-2018-05789 Missing authorization in Apache ZooKeeper CVSS 3.1HIGH 7.5
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences