CVE-2026-59969

Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted peer certificate whose SAN does not match the connected host. A malicious or misissued peer certificate can therefore join quorum traffic, participate in leader election, and enter replication flows. Users are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/qf9kwsgtgbgtvwls6f41281846xg0rss	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/09/15/4	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:apache:zookeeper::::::::
	cpe:2.3:a:apache:zookeeper::::::::

History

18 Sep 2026, 14:31

Type	Values Removed	Values Added
First Time		Apache Apache zookeeper
CPE		cpe:2.3:a:apache:zookeeper::::::::
References	~~() https://lists.apache.org/thread/qf9kwsgtgbgtvwls6f41281846xg0rss -~~	() https://lists.apache.org/thread/qf9kwsgtgbgtvwls6f41281846xg0rss - Mailing List, Vendor Advisory
References	~~() http://www.openwall.com/lists/oss-security/2026/09/15/4 -~~	() http://www.openwall.com/lists/oss-security/2026/09/15/4 - Mailing List, Third Party Advisory

17 Sep 2026, 20:16

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.5

Information

Published : 2026-09-16 10:16

Updated : 2026-09-18 14:31

NVD link : CVE-2026-59969

Mitre link : CVE-2026-59969

CVE.ORG link : CVE-2026-59969

JSON object : View

Products Affected

apache

zookeeper

CWE

CWE-297

Improper Validation of Certificate with Host Mismatch

{"id": "CVE-2026-59969", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59969", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-17T19:16:38.006304Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache ZooKeeper", "versions": [{"status": "affected", "version": "3.9.0", "versionType": "maven", "lessThanOrEqual": "3.9.5"}, {"status": "affected", "version": "3.8.0", "versionType": "maven", "lessThanOrEqual": "3.8.6"}], "packageURL": "pkg:maven/org.apache.zookeeper/zookeeper", "packageName": "org.apache.zookeeper:zookeeper", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}]}], "published": "2026-09-16T10:16:51.220", "references": [{"url": "https://lists.apache.org/thread/qf9kwsgtgbgtvwls6f41281846xg0rss", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/09/15/4", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-297"}]}], "descriptions": [{"lang": "en", "value": "Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true\u00a0are enabled, the Java SSLSocket\u00a0quorum path accepts a CA-trusted peer certificate whose SAN does not match the connected host. A malicious or misissued peer certificate can therefore join quorum traffic, participate in leader election, and enter replication flows.\n\n\n\nUsers are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue."}], "lastModified": "2026-09-18T14:31:23.357", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:zookeeper:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4EB0BE5E-6F39-4D77-BBEC-89AE61429E31", "versionEndExcluding": "3.8.7", "versionStartIncluding": "3.8.0"}, {"criteria": "cpe:2.3:a:apache:zookeeper:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "78E0C560-E216-4628-9131-E8C919D8B937", "versionEndExcluding": "3.9.6", "versionStartIncluding": "3.9.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}