Users are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Apache Software Foundation | Apache ZooKeeper | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Wed, 16 Sep 2026 09:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted peer certificate whose SAN does not match the connected host. A malicious or misissued peer certificate can therefore join quorum traffic, participate in leader election, and enter replication flows. Users are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue. | |
| Title | Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode | |
| Weaknesses | CWE-297 | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: apache
Published:
Updated: 2026-09-16T10:11:44.041Z
Reserved: 2026-07-07T18:50:40.959Z
Link: CVE-2026-59969
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-09-16T10:16:51.220
Modified: 2026-09-16T10:16:51.220
Link: CVE-2026-59969
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-297
Improper Validation of Certificate with Host Mismatch