CVE-2026-59969

Katalog CVE

CVSS 7.5 · High EPSS 0,33%

Kerentanan Improper Validation of Certificate with Host Mismatch pada apache zookeeper. Skor CVSS 3.1 7.5 (High) menurut CISA ADP.

Deskripsi (NVD)

Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted peer certificate whose SAN does not match the connected host. A malicious or misissued peer certificate can therefore join quorum traffic, participate in leader election, and enter replication flows. Users are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.

Rincian

Terbit di NVD

16 September 2026

Terakhir diubah

18 September 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-297: Improper Validation of Certificate with Host Mismatch

EPSS (30 hari)

0,33% peluang dieksploitasi; lebih tinggi dari 24,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/qf9kwsgtgbgtvwls6f41281846xg0rss mailing list · advisory vendor
• http://www.openwall.com/lists/oss-security/2026/09/15/4 mailing list · advisory pihak ketiga