Review reviewHigh

CVE-2026-24281

Apache Software Foundation Apache ZooKeeper, Red Hat AMQ Broker 7.12.7, Red Hat AMQ Broker 7.13.5

Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.

CVSS: 7.4
EPSS: 0.63%
CISA KEV: Not listed
Published: 2026.03.07

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.63%

Technical severityCVSS 7.4

Vulnerability overview

Affected product and versions

Product: Apache Software Foundation Apache ZooKeeper, Red Hat AMQ Broker 7.12.7, Red Hat AMQ Broker 7.13.5
Affected versions: >= 3.9.0 <= 3.9.4, >= 3.8.0 <= 3.8.5, >= 3.8.0 < 3.8.6, >= 3.9.0 < 3.9.5
Fixed versions: 3.8.6, 3.9.5

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Apache Software Foundation Apache ZooKeeper, Red Hat AMQ Broker 7.12.7, Red Hat AMQ Broker 7.13.5 and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE: CWE-295, CWE-350