Skip to content
fr Sign in
Not rated

CVE-2026-24281 Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails,…

Description

Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.

Affected products and versions

Product Affected versions Fixed in
Red Hat AMQ Broker 7.12.7 Versions not published
Red Hat AMQ Broker 7.13.5 Versions not published
Red Hat AMQ Broker 7.14.0 Versions not published
Red Hat OpenShift AI 2.25 1776756834 earliest → < 1776756834 1776756834
Red Hat build of Debezium 2 Versions not published
Red Hat build of Debezium 3 Versions not published
Red Hat Fuse 7 Versions not published
Red Hat JBoss Enterprise Application Platform Expansion Pack Versions not published
Red Hat Offline Knowledge Portal Versions not published
Show the 10 other branches
Product Affected versions Fixed in
Red Hat OpenShift AI (RHOAI) Versions not published
streams for Apache Kafka 2 Versions not published
streams for Apache Kafka 3 Versions not published
Red Hat build of Apache Camel for Spring Boot 4 Versions not published
Red Hat Data Grid 8 Versions not published
Red Hat JBoss Enterprise Application Platform 7 Versions not published
Red Hat JBoss Enterprise Application Platform 8 Versions not published
Apache ZooKeeper 3.9 3.9.0 → 3.9.4 No fix stated
Apache ZooKeeper 3.8 3.8.0 → 3.8.5 No fix stated
Streams for Apache Kafka 2.9.4 Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Red Hat AMQ Broker 7.12.7

The 7 CVEs of Red Hat AMQ Broker 7.12.7 →
CVE-2026-5588 Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc 6.3 Medium CVE-2026-0636 Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the… 5.5 Medium CVE-2025-14813 : Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc 9.3 Critical CVE-2026-33871 Netty is an asynchronous, event-driven network application framework 8.7 High
Track this CVE