https://seclists.org/oss-sec/2026/q1/269: CVE-2026-24281: Apache ZooKeeper: verse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager
Published Mar 7, 2026
·Updated
Affected Software
1 affected component
Apache Zookeeper>=3.8.0<=3.8.5, >=3.9.0<=3.9.4
Frequently Asked Questions
1
What is the severity of CVE-2026-24281?
The severity of CVE-2026-24281 is classified as important.
2
Which versions of Apache ZooKeeper are affected by CVE-2026-24281?
CVE-2026-24281 affects Apache ZooKeeper versions 3.9.0 through 3.9.4 and 3.8.0 through 3.8.5.
3
How does CVE-2026-24281 impact hostname verification in Apache ZooKeeper?
CVE-2026-24281 allows a hostname verification bypass in ZKTrustManager by enabling fallback to reverse DNS.
4
How can I fix CVE-2026-24281 in my Apache ZooKeeper installation?
To fix CVE-2026-24281, upgrade your Apache ZooKeeper to a version that is not affected: 3.9.5 or later for version 3.9.x, and 3.8.6 or later for version 3.8.x.
5
What is ZKTrustManager in relation to CVE-2026-24281?
ZKTrustManager is a component in Apache ZooKeeper responsible for hostname verification, which is impacted by CVE-2026-24281 due to a fallback mechanism to reverse DNS.