CVE-2026-24281

{"id": "CVE-2026-24281", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.2}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "published": "2026-03-07T09:16:07.437", "references": [{"url": "https://lists.apache.org/thread/088ddsbrzhd5lxzbqf5n24yg0mwh9jt2", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/03/07/4", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-295"}, {"lang": "en", "value": "CWE-350"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-295"}]}], "descriptions": [{"lang": "en", "value": "Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols."}, {"lang": "es", "value": "La verificaci\u00f3n de nombre de host en Apache ZooKeeper ZKTrustManager recurre a DNS inverso (PTR) cuando falla la validaci\u00f3n IP SAN, permitiendo a los atacantes que controlan o falsifican registros PTR suplantar servidores o clientes de ZooKeeper con un certificado v\u00e1lido para el nombre PTR. Es importante se\u00f1alar que el atacante debe presentar un certificado que sea de confianza para ZKTrustManager, lo que hace que el vector de ataque sea m\u00e1s dif\u00edcil de explotar. Se recomienda a los usuarios actualizar a la versi\u00f3n 3.8.6 o 3.9.5, que corrige este problema al introducir una nueva opci\u00f3n de configuraci\u00f3n para deshabilitar la b\u00fasqueda de DNS inverso en los protocolos de cliente y qu\u00f3rum."}], "lastModified": "2026-03-10T18:18:17.727", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:zookeeper:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1D3E8670-F4DD-400A-A459-9396353D5E7A", "versionEndExcluding": "3.8.6", "versionStartIncluding": "3.8.0"}, {"criteria": "cpe:2.3:a:apache:zookeeper:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "69917DB8-268C-4F60-AFAE-51FB24101BFE", "versionEndExcluding": "3.9.5", "versionStartIncluding": "3.9.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}