{"id":"CVE-2026-59969","title":"Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments","summary":"Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are ena…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cwe":["CWE-297","CWE-295"],"vendor":"apache","product":"zookeeper","affected":["zookeeper >= 3.8.0, < 3.8.7","zookeeper >= 3.9.0, < 3.9.6"],"patched":["zookeeper 3.9.6"],"published":"2026-09-16","updated":"2026-09-18","sourceUpdated":"2026-09-18T14:31:23.357","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-59969","references":[{"url":"https://lists.apache.org/thread/qf9kwsgtgbgtvwls6f41281846xg0rss","label":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/15/4","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59969.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-59969"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535097"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59969"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59969"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"epss":0.0033,"epssPercentile":0.25936,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-17T19:16:38.006304Z"},"ingestedAt":"2026-09-16T09:53:11.604Z","scores":{"nvd":7.5,"vendor":9},"slug":"CVE-2026-59969","body":"## Overview\n\nApache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted peer certificate whose SAN does not match the connected host. A malicious or misissued peer certificate can therefore join quorum traffic, participate in leader election, and enter replication flows.\n\n\n\nUsers are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.\n\n## Affected\n\n- `zookeeper >= 3.8.0, < 3.8.7`\n- `zookeeper >= 3.9.0, < 3.9.6`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `zookeeper 3.9.6`\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Red Hat AMQ Broker 7, Red Hat build of Apache Camel for Spring Boot 4, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat Offline Knowledge Portal, Red Hat OpenShift AI (RHOAI) · no fix planned: Red Hat OpenShift AI (RHOAI), Red Hat AMQ Broker 7, Red Hat build of Apache Camel for Spring Boot 4, Red Hat JBoss Enterprise Application Platform Expansion Pack, … · updated 2026-10-05 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59969.json)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":206519,"id":"CVE-2026-59969","ts":1789673253105,"field":"cvss","old":null,"new":"7.5"},{"seq":206518,"id":"CVE-2026-59969","ts":1789673253105,"field":"severity","old":"none","new":"high"}]}