GHSA-7XRH-HQFC-G7QR Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager

🗓️ 07 Mar 2026 09:30:15Reported by GoogleType

osv🔗 osv.dev👁 3 Views

PTR DNS fallback may bypass hostname verification in ZooKeeper ZKTrustManager; upgrade to 3.8.6 or 3.9.5 to disable reverse DNS.

Reporter	Title	Published	Views	Family All 82
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Apache ZooKeeper	24 Jun 202621:38	–	ibm
IBM Security Bulletins	Security Bulletin: The following vulnerabilities that can affect IBM Storage Scale Management GUI, Cluster Export Services (CES) S3 or HDFS layer are now fixed in 5.2.3.8 and 6.0.1.0 or higher	5 Jun 202619:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operational Decision Manager for April 2026 - Multiple CVEs addressed	29 May 202610:57	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in zookeeper-3.8.4.jar	28 Apr 202619:11	–	ibm
ATTACKERKB	CVE-2026-24281	7 Mar 202608:50	–	attackerkb
Tenable Nessus	Apache ZooKeeper 3.8.x < 3.8.6 / 3.9.x < 3.9.5 Multiple Vulnerabilities	12 Mar 202600:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2026-24281	10 Mar 202600:00	–	nessus
Chainguard	CVE-2026-24281 vulnerabilities	12 Mar 202607:18	–	cgr
Circl	CVE-2026-24281	7 Mar 202608:16	–	circl
CNNVD	Apache Zookeeper 安全漏洞	7 Mar 202600:00	–	cnnvd

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-24281
github	www.github.com/apache/zookeeper/commit/66c4efecdda1302d9cfb3af9eedb122b74452bf3
github	www.github.com/apache/zookeeper
issues	www.issues.apache.org/jira/browse/ZOOKEEPER-4986
lists	www.lists.apache.org/thread/088ddsbrzhd5lxzbqf5n24yg0mwh9jt2
openwall	www.openwall.com/lists/oss-security/2026/03/07/4

16 Mar 2026 03:00Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.17.4

EPSS0.00633