DEBIAN-CVE-2026-24281

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-24281
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-24281.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-24281
Upstream
Published
2026-03-07T09:16:07.437Z
Modified
2026-03-13T06:41:36.505444Z
Severity
  • 7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
[none]
Details

Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.

References

Affected packages

Debian:11 / zookeeper

Package

Name
zookeeper
Purl
pkg:deb/debian/zookeeper?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.4.13-6
3.4.13-6+deb11u1
3.8.0-1
3.8.0-2
3.8.0-3
3.8.0-4
3.8.0-5
3.8.0-6
3.8.0-7
3.8.0-8
3.8.0-9
3.8.0-10
3.8.0-11
3.9.1-1
3.9.2-1
3.9.2-2
3.9.3-1
3.9.3-2
3.9.4-1
3.9.4-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-24281.json"

Debian:12 / zookeeper

Package

Name
zookeeper
Purl
pkg:deb/debian/zookeeper?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.8.0-11
3.8.0-11+deb12u1
3.8.0-11+deb12u2
3.9.1-1
3.9.2-1
3.9.2-2
3.9.3-1
3.9.3-2
3.9.4-1
3.9.4-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-24281.json"

Debian:13 / zookeeper

Package

Name
zookeeper
Purl
pkg:deb/debian/zookeeper?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.9.3-1
3.9.3-1+deb13u1
3.9.3-2
3.9.4-1
3.9.4-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-24281.json"

Debian:14 / zookeeper

Package

Name
zookeeper
Purl
pkg:deb/debian/zookeeper?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.9.3-1
3.9.3-2
3.9.4-1
3.9.4-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-24281.json"