CLEANSTART-2026-CF62516 Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper s...

🗓️ 16 Apr 2026 00:42:51Reported by GoogleType

osv🔗 osv.dev👁 13 Views

ZooKeeper trust manager uses reverse domain spoofing on IP address validation failure, enabling impersonation.

Reporter	Title	Published	Views	Family All 1087
Redos	ROS-20260713-73-0037	13 Jul 202600:00	–	redos
Redos	ROS-20260713-73-0038	13 Jul 202600:00	–	redos
Redos	ROS-20260713-73-0039	13 Jul 202600:00	–	redos
Redos	ROS-20260714-73-0067	14 Jul 202600:00	–	redos
Redos	ROS-20260714-73-0068	14 Jul 202600:00	–	redos
Redos	ROS-20260216-73-0011	16 Feb 202600:00	–	redos
Redos	ROS-20260224-73-0013	24 Feb 202600:00	–	redos
Redos	ROS-20260624-73-0021	24 Jun 202600:00	–	redos
Redos	ROS-20260624-73-0022	24 Jun 202600:00	–	redos
Snyk	Use After Free	9 Apr 202616:14	–	snyk

Source	Link
github	www.github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-CF62516.json
osv	www.osv.dev/vulnerability/CVE-2025-67735
osv	www.osv.dev/vulnerability/CVE-2025-68161
osv	www.osv.dev/vulnerability/CVE-2026-1225
osv	www.osv.dev/vulnerability/CVE-2026-24281
osv	www.osv.dev/vulnerability/CVE-2026-24308
osv	www.osv.dev/vulnerability/CVE-2026-33870
osv	www.osv.dev/vulnerability/CVE-2026-33871
osv	www.osv.dev/vulnerability/CVE-2026-34757
osv	www.osv.dev/vulnerability/ghsa-25qh-j22f-pwp8

23 Apr 2026 05:01Current

6.6Medium risk

Vulners AI Score6.6

CVSS 3.19.8

EPSS0.01177