CVE-2026-24281
Received Received - Intake
Hostname Verification Bypass in Apache ZooKeeper via PTR Spoofing

Publication date: 2026-03-07

Last updated on: 2026-03-10

Assigner: Apache Software Foundation

Description
Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-07
Last Modified
2026-03-10
Generated
2026-06-16
AI Q&A
2026-03-07
EPSS Evaluated
2026-06-14
NVD
CVE-2026-24281
EUVD
EUVD-2026-10139
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
apache zookeeper From 3.8.0 (inc) to 3.8.6 (exc)
apache zookeeper From 3.9.0 (inc) to 3.9.5 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-350 The product performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.
CWE-295 The product does not validate, or incorrectly validates, a certificate.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability involves hostname verification in Apache ZooKeeper's ZKTrustManager. When IP Subject Alternative Name (SAN) validation fails, the system falls back to reverse DNS (PTR) lookup. Attackers who control or spoof PTR records can exploit this fallback to impersonate ZooKeeper servers or clients by presenting a valid certificate for the PTR name.

However, the attacker must present a certificate trusted by ZKTrustManager, which makes the attack more difficult to execute.

The issue is fixed in versions 3.8.6 and 3.9.5 by adding a configuration option to disable reverse DNS lookup in client and quorum protocols.

Impact Analysis

If exploited, this vulnerability allows attackers to impersonate legitimate ZooKeeper servers or clients by spoofing PTR records and presenting trusted certificates. This can lead to unauthorized access, man-in-the-middle attacks, or disruption of ZooKeeper communications.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, users are recommended to upgrade Apache ZooKeeper to version 3.8.6 or 3.9.5.

These versions fix the issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols, preventing attackers from exploiting PTR record spoofing.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-24281. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart