[<prev] [next>] [day] [month] [year] [list]
Message-ID: <d2270956-068a-b565-fa9e-94eb1ed26cf4@apache.org>
Date: Sat, 07 Mar 2026 00:06:06 +0000
From: Andor Molnar <andor@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2026-24281: Apache ZooKeeper: Reverse-DNS fallback enables
hostname verification bypass in ZooKeeper ZKTrustManager
Severity: important
Affected versions:
- Apache ZooKeeper (org.apache.zookeeper:zookeeper) 3.9.0 through 3.9.4
- Apache ZooKeeper (org.apache.zookeeper:zookeeper) 3.8.0 through 3.8.5
Description:
Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.
This issue is being tracked as ZOOKEEPER-4986
Credit:
Nikita Markevich <markevich.nikita1@...il.com> (reporter)
References:
https://zookeeper.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-24281
https://issues.apache.org/jira/browse/ZOOKEEPER-4986
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
