CLEANSTART-2026-CF62516 Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper s...

🗓️ 16 Apr 2026 00:42:51Reported by GoogleType

osv🔗 osv.dev👁 14 Views

ZooKeeper trust manager uses reverse domain spoofing on IP address validation failure, enabling impersonation.

Reporter	Title	Published	Views	Family All 1104
RedhatCVE	CVE-2025-67735	17 Dec 202510:02	–	redhatcve
RedhatCVE	CVE-2025-68161	28 Dec 202521:38	–	redhatcve
RedhatCVE	CVE-2026-1225	27 Jan 202618:51	–	redhatcve
RedhatCVE	CVE-2026-24281	9 Mar 202613:20	–	redhatcve
RedhatCVE	CVE-2026-24308	9 Mar 202613:20	–	redhatcve
RedhatCVE	CVE-2026-33870	27 Mar 202623:27	–	redhatcve
RedhatCVE	CVE-2026-33871	30 Mar 202616:43	–	redhatcve
RedhatCVE	CVE-2026-34757	9 Apr 202622:21	–	redhatcve
RedHat Linux	netty-codec-http: Netty (netty-codec-http): Request Smuggling via CRLF Injection	5 Feb 202614:43	–	redhat
RedHat Linux	Moderate: Red Hat Security Advisory: Red Hat build of Quarkus 3.27.2 release and security update	5 Feb 202614:53	–	redhat

Source	Link
github	www.github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-CF62516.json
osv	www.osv.dev/vulnerability/CVE-2025-67735
osv	www.osv.dev/vulnerability/CVE-2025-68161
osv	www.osv.dev/vulnerability/CVE-2026-1225
osv	www.osv.dev/vulnerability/CVE-2026-24281
osv	www.osv.dev/vulnerability/CVE-2026-24308
osv	www.osv.dev/vulnerability/CVE-2026-33870
osv	www.osv.dev/vulnerability/CVE-2026-33871
osv	www.osv.dev/vulnerability/CVE-2026-34757
osv	www.osv.dev/vulnerability/ghsa-25qh-j22f-pwp8

23 Apr 2026 05:01Current

6.6Medium risk

Vulners AI Score6.6

CVSS 3.19.8

EPSS0.01177