CVE-2026-24281

HighCVSS 7.4/10Last modified Jul 15, 2026

Description

Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-295CWE-350

Affected software

VendorProductVersions
Apache Software FoundationApache ZooKeeper>= 3.9.0, <= 3.9.4; >= 3.8.0, <= 3.8.5
Red HatRed Hat AMQ Broker 7.12.7—
Red HatRed Hat AMQ Broker 7.13.5—
Red HatRed Hat AMQ Broker 7.14.0—
Red HatStreams for Apache Kafka 2.9.4—
Red HatRed Hat OpenShift AI 2.25—
Red HatRed Hat build of Apache Camel for Spring Boot 4—
Red HatRed Hat build of Debezium 2—
Red HatRed Hat build of Debezium 3—
Red HatRed Hat Data Grid 8—
Red HatRed Hat Fuse 7—
Red HatRed Hat JBoss Enterprise Application Platform 7—
Red HatRed Hat JBoss Enterprise Application Platform 8—
Red HatRed Hat JBoss Enterprise Application Platform Expansion Pack—
Red HatRed Hat Offline Knowledge Portal—
Red HatRed Hat OpenShift AI (RHOAI)—
Red Hatstreams for Apache Kafka 3—

References

Timeline

Published
Mar 7, 2026
Last modified
Jul 15, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-242825.5Out-of-bounds read in Push Message Routing Service allows an authorized attacker to disclose information locally.CVE-2026-242838.8Heap-based buffer overflow in Windows File Server allows an authorized attacker to elevate privileges locally.CVE-2026-242857.0Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.CVE-2026-242877.8External control of file name or path in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-242886.8Heap-based buffer overflow in Windows Mobile Broadband allows an unauthorized attacker to execute code with a physical attack.CVE-2026-242897.8Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-24294.9The Community Events plugin for WordPress is vulnerable to SQL Injection via the 'ce_venue_name' CSV field in the `on_save_changes_venues` fCVE-2026-242907.8Improper access control in Windows Projected File System allows an authorized attacker to elevate privileges locally.CVE-2026-242917.8Incorrect permission assignment for critical resource in Windows Accessibility Infrastructure (ATBroker.exe) allows an authorized attacker tCVE-2026-242927.8Use after free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally.CVE-2026-242937.8Null pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.CVE-2026-242947.8Improper authentication in Windows SMB Server allows an authorized attacker to elevate privileges locally.
CVE-2026-24281: High severity, CVSS 7.4 | Vulnix