CVE-2026-24281
Hostname Verification Bypass in Apache ZooKeeper via PTR Spoofing
Publication date: 2026-03-07
Last updated on: 2026-03-10
Assigner: Apache Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | zookeeper | From 3.8.0 (inc) to 3.8.6 (exc) |
| apache | zookeeper | From 3.9.0 (inc) to 3.9.5 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-295 | The product does not validate, or incorrectly validates, a certificate. |
| CWE-350 | The product performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves hostname verification in Apache ZooKeeper's ZKTrustManager. When IP Subject Alternative Name (SAN) validation fails, the system falls back to reverse DNS (PTR) lookup. Attackers who control or spoof PTR records can exploit this fallback to impersonate ZooKeeper servers or clients by presenting a valid certificate for the PTR name.
However, the attacker must present a certificate trusted by ZKTrustManager, which makes the attack more difficult to execute.
The issue is fixed in versions 3.8.6 and 3.9.5 by adding a configuration option to disable reverse DNS lookup in client and quorum protocols.
How can this vulnerability impact me? :
If exploited, this vulnerability allows attackers to impersonate legitimate ZooKeeper servers or clients by spoofing PTR records and presenting trusted certificates. This can lead to unauthorized access, man-in-the-middle attacks, or disruption of ZooKeeper communications.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, users are recommended to upgrade Apache ZooKeeper to version 3.8.6 or 3.9.5.
These versions fix the issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols, preventing attackers from exploiting PTR record spoofing.