CVE-2026-24281

Katalog CVE

CVSS 7.4 · High EPSS 0,65%

Kerentanan Improper Certificate Validation pada apache zookeeper. Skor CVSS 3.1 7.4 (High) menurut NVD.

Deskripsi (NVD)

Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.

Rincian

Terbit di NVD

7 Maret 2026

Terakhir diubah

15 Juli 2026

Status NVD

Modified

CVSS 3.1

7.4 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-295: Improper Certificate Validation
CWE-350: Reliance on Reverse DNS Resolution for a Security-Critical Action

EPSS (30 hari)

0,65% peluang dieksploitasi; lebih tinggi dari 49,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/088ddsbrzhd5lxzbqf5n24yg0mwh9jt2 mailing list · advisory vendor
• http://www.openwall.com/lists/oss-security/2026/03/07/4 mailing list · advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2026:10184
• https://access.redhat.com/errata/RHSA-2026:14272
• https://access.redhat.com/errata/RHSA-2026:14276
• https://access.redhat.com/errata/RHSA-2026:34608
• https://access.redhat.com/errata/RHSA-2026:8509
• https://access.redhat.com/security/cve/CVE-2026-24281
• https://bugzilla.redhat.com/show_bug.cgi?id=2445449
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24281.json