Hostname verification in Apache ZooKeeper’s ZKTrustManager falls back to using reverse DNS (PTR) records when subject alternative name validation of an IP fails. This flaw allows an attacker who controls or can spoof PTR entries to make a server or client appear to present a valid certificate for the PTR name. The result is that malicious components can impersonate legitimate ZooKeeper peers, gaining unauthorized access and potentially authenticating as trusted nodes. The weakness is related to improper validation of hostnames (CWE-295) and failure to properly verify cryptographic parameters (CWE-350).

The vulnerability affects Apache ZooKeeper versions that use the default configuration of ZKTrustManager. Users should verify the installed package is prior to 3.8.6 or 3.9.5. Upgrading to version 3.8.6 or 3.9.5, which introduce a configuration option to disable reverse DNS lookup in client and quorum protocols, eliminates the risk. The vendor is the Apache Software Foundation.

The CVSS score of 5.9 indicates a moderate impact if exploited. However, the EPSS score of less than 1% reflects a very low probability of real-world exploitation. Exploitation requires the attacker to possess a certificate trusted by the ZooKeeper trust manager and to control PTR records pointing to this certificate. The vulnerability is not listed in CISA’s KEV, so no widespread exploitation reports are known. The risk remains lower than major threats but sufficient to justify immediate patching if the environment uses a vulnerable ZooKeeper version.