CVE-2026-24281

🗓️ 07 Mar 2026 08:50:32Reported by Debian Security Bug TrackerType

CVE-2026-24281: Zookeeper may use reverse domain name if IP SAN fails, enabling impersonation; upgrade to 3.8.6 or 3.9.5 to disable.

Reporter	Title	Published	Views	Family All 82
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Apache ZooKeeper	24 Jun 202621:38	–	ibm
IBM Security Bulletins	Security Bulletin: The following vulnerabilities that can affect IBM Storage Scale Management GUI, Cluster Export Services (CES) S3 or HDFS layer are now fixed in 5.2.3.8 and 6.0.1.0 or higher	5 Jun 202619:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operational Decision Manager for April 2026 - Multiple CVEs addressed	29 May 202610:57	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in zookeeper-3.8.4.jar	28 Apr 202619:11	–	ibm
ATTACKERKB	CVE-2026-24281	7 Mar 202608:50	–	attackerkb
Tenable Nessus	Apache ZooKeeper 3.8.x < 3.8.6 / 3.9.x < 3.9.5 Multiple Vulnerabilities	12 Mar 202600:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2026-24281	10 Mar 202600:00	–	nessus
Chainguard	CVE-2026-24281 vulnerabilities	12 Mar 202607:18	–	cgr
Circl	CVE-2026-24281	7 Mar 202608:16	–	circl
CNNVD	Apache Zookeeper 安全漏洞	7 Mar 202600:00	–	cnnvd

OS	OS Version	Architecture	Package	Package Version	Filename
Debian	14	any	zookeeper	3.9.5-1	zookeeper_3.9.5-1_any.deb
Debian	999	any	zookeeper	3.9.5-1	zookeeper_3.9.5-1_any.deb
Debian	11	any	zookeeper	3.4.13-6+deb11u1	zookeeper_3.4.13-6+deb11u1_any.deb
Debian	12	any	zookeeper	3.8.0-11+deb12u2	zookeeper_3.8.0-11+deb12u2_any.deb
Debian	13	any	zookeeper	3.9.3-1+deb13u1	zookeeper_3.9.3-1+deb13u1_any.deb

07 Mar 2026 08:50Current

8.4High risk

Vulners AI Score8.4

CVSS 3.17.4

EPSS0.00633

SSVC