Cloudanix VulnDB

CVE-2026-24281

High · 7.4

CVSS

7.4

EPSS

0.6%

Published

Mar 7, 2026

CISA due date

—

The record

Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.

Affected packages

Ecosystem Package Introduced Fixed
Chainguard akhq 0 0.26.0-r11
Chainguard apache-activemq-artemis 0 2.53.0-r2
Chainguard apache-nifi 0 2.8.0-r4
Chainguard apache-pulsar-4.1 0 4.1.3-r7
Chainguard apache-pulsar-fips-4.1 0 4.1.3-r7
Chainguard kafka-3.8 0 3.8.1-r53
Chainguard kafka-3.9 0 3.9.2-r4
Chainguard kserve-modelmesh 0 0.12.0-r26
Chainguard seata-server 0 2.6.0-r4
Chainguard solr 0 10.0.0-r1
Chainguard spark-3.5-scala-2.12 0 3.5.8-r6
Chainguard spark-3.5-scala-2.13 0 3.5.8-r6
Chainguard spark-4.0-scala-2.13 0 4.0.2-r7
Chainguard spark-4.1-scala-2.13 0 4.1.1-r7
Chainguard spark-fips-3.5-scala-2.12 0 3.5.4-r25
Chainguard spark-kubernetes-operator 0 0.7.0-r4
Chainguard spark-kubernetes-operator-fips 0 0.7.0-r2
Chainguard strimzi-kafka-operator-kafka-thirdparty-libs-cc 0 0.51.0-r1
Chainguard trino-plugin-kafka 0 480-r0
Chainguard trino-plugin-kafka-event-listener 0 480-r0
Chainguard trino-plugin-pinot 0 480-r0
Chainguard trino-plugin-ranger 0 480-r0
Chainguard zookeeper-3.9 0 3.9.5-r0
Chainguard zookeeper-fips-3.9 0 3.9.5-r0
Wolfi akhq 0 0.26.0-r11
Wolfi apache-activemq-artemis 0 2.53.0-r2
Wolfi apache-nifi 0 2.8.0-r4
Wolfi apache-pulsar-4.1 0 4.1.3-r7
Wolfi kafka-3.8 0 3.8.1-r53
Wolfi kafka-3.9 0 3.9.2-r4
Wolfi kserve-modelmesh 0 0.12.0-r26
Wolfi solr 0 10.0.0-r1
Wolfi spark-3.5-scala-2.12 0 3.5.8-r6
Wolfi spark-3.5-scala-2.13 0 3.5.8-r6
Wolfi spark-4.0-scala-2.13 0 4.0.2-r7
Wolfi spark-4.1-scala-2.13 0 4.1.1-r7
Wolfi strimzi-kafka-operator-kafka-thirdparty-libs-cc 0 0.51.0-r1
Wolfi trino-plugin-kafka 0 480-r0
Wolfi trino-plugin-kafka-event-listener 0 480-r0
Wolfi trino-plugin-pinot 0 480-r0
Wolfi trino-plugin-ranger 0 480-r0
Wolfi zookeeper-3.9 0 3.9.5-r0

Related vulnerabilities