{"action":"Upgrade org.apache.zookeeper:zookeeper to 3.8.6 (3.8.x) or 3.9.5 (3.9.x) or later.","affected":[{"fixed":"3.8.6","introduced":"3.8.0"},{"fixed":"3.9.5","introduced":"3.9.0"}],"component":"org.apache.zookeeper:zookeeper","cve_ids":["CVE-2026-24281"],"ecosystem":"Maven","epss":0.00645,"exploited":false,"fixed_versions":["3.8.6","3.9.5"],"ghsa_id":"GHSA-7xrh-hqfc-g7qr","id":"tcs_01M5N8KEM9PQKFAQA46SN9T21M","modified_at":"2026-09-10T03:50:38.276709868Z","published_at":"2026-03-07T09:30:15Z","references":["https://osv.dev/vulnerability/GHSA-7xrh-hqfc-g7qr","https://nvd.nist.gov/vuln/detail/CVE-2026-24281","https://github.com/apache/zookeeper/commit/66c4efecdda1302d9cfb3af9eedb122b74452bf3","https://github.com/apache/zookeeper","https://issues.apache.org/jira/browse/ZOOKEEPER-4986","https://lists.apache.org/thread/088ddsbrzhd5lxzbqf5n24yg0mwh9jt2","http://www.openwall.com/lists/oss-security/2026/03/07/4"],"severity":{"label":"high","score":7.4},"sources":[{"source":"osv","source_id":"GHSA-7xrh-hqfc-g7qr","url":"https://osv.dev/vulnerability/GHSA-7xrh-hqfc-g7qr"}],"summary":"Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager"}