---
id: CVE-2026-59969
title: >-
  Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in
  FIPS-mode deployments
summary: "Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true\_are ena…"
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'
cwe:
  - CWE-297
  - CWE-295
vendor: apache
product: zookeeper
affected:
  - 'zookeeper >= 3.8.0, < 3.8.7'
  - 'zookeeper >= 3.9.0, < 3.9.6'
patched:
  - zookeeper 3.9.6
published: '2026-09-16'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T14:31:23.357'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-59969'
references:
  - url: 'https://lists.apache.org/thread/qf9kwsgtgbgtvwls6f41281846xg0rss'
    label: security@apache.org
  - url: 'http://www.openwall.com/lists/oss-security/2026/09/15/4'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59969.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-59969'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2535097'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-59969'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-59969'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.0033
epssPercentile: 0.25936
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-17T19:16:38.006304Z'
ingestedAt: '2026-09-16T09:53:11.604Z'
scores:
  nvd: 7.5
  vendor: 9
---

## Overview

Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted peer certificate whose SAN does not match the connected host. A malicious or misissued peer certificate can therefore join quorum traffic, participate in leader election, and enter replication flows.



Users are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.

## Affected

- `zookeeper >= 3.8.0, < 3.8.7`
- `zookeeper >= 3.9.0, < 3.9.6`

## Remediation

Upgrade past the affected range:

- `zookeeper 3.9.6`

## Vendor advisories

- **Red Hat VEX** · Important · affected: Red Hat AMQ Broker 7, Red Hat build of Apache Camel for Spring Boot 4, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat Offline Knowledge Portal, Red Hat OpenShift AI (RHOAI) · no fix planned: Red Hat OpenShift AI (RHOAI), Red Hat AMQ Broker 7, Red Hat build of Apache Camel for Spring Boot 4, Red Hat JBoss Enterprise Application Platform Expansion Pack, … · updated 2026-10-05 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59969.json)