Detections
Analytics

SCA: security update for org.apache.zookeeper:zookeeper (GHSA-7xrh-hqfc-g7qr)

high Tenable Cloud Security Plugin ID 438625

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN
 validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or
 clients with a valid certificate for the PTR name. It's important to note that attacker must present a
 certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are
 recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new
 configuration option to disable reverse DNS lookup in client and quorum protocols. (CVE-2026-24281)

Solution

Update the org.apache.zookeeper:zookeeper library and its related packages to version 3.8.6 or later.

See Also

https://github.com/advisories/GHSA-7xrh-hqfc-g7qr

Plugin Details

Severity: High

ID: 438625

Version: Revision 1.3

Type: Local

Family: SCA Checks

Published: 3/11/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.64

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.1

Temporal Score: 5.3

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:N

CVSS Score Source: CVE-2026-24281

CVSS v3

Risk Factor: High

Base Score: 7.4

Temporal Score: 6.4

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 3/7/2026

Vulnerability Publication Date: 3/7/2026

Reference Information

CVE: CVE-2026-24281