CLEANSTART-2026-HI98113: Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments
Published Nov 13, 2026
·Updated
Security vulnerability affects the solr package. Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments.
Affected Software
1 affected componentFixes available
cleanstart/solr<9.11.0-r2
9.11.0-r2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/solrto a version that resolves this vulnerability.Fixed in 9.11.0-r2
Event History
Nov 13, 2026
Advisory Published
via OSV·12:37 AM
Data Sourced
via OSV·12:37 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Which deployments are in scope?
The issue is described as affecting Apache ZooKeeper quorum TLS in FIPS-mode deployments of the solr package. The available data does not state whether non-FIPS deployments are affected.
2
Does exploitation require credentials or user interaction?
The supplied vector indicates network reachability, low attack complexity, no required privileges, and no user interaction. It reports an integrity impact, with no confidentiality or availability impact listed.