Debian/zookeeper: high 7.4
Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper serv
Action: Upgrade zookeeper to 3.9.5-1 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.9.5-1 | - |
Fixed versions
| 3.9.5-1 |
Sources
- osv: DEBIAN-CVE-2026-24281#Debian:14/zookeeper
- https://security-tracker.debian.org/tracker/CVE-2026-24281
published · modified · JSON