CVE-2026-59969 Apache Software Foundation CVE debrief

Who should care

Defenders and administrators of Apache ZooKeeper deployments should assess exposure and prioritize upgrading to fixed versions. They should verify hostname verification settings to prevent malicious or misissued peer certificates from joining quorum traffic. This involves reviewing and updating sslQuorum, zookeeper.fips-mode, ssl.quorum.hostnameVerification, and ssl.quorum.clientHostnameVerification settings. Security teams and vulnerability management  

Why it matters

Defenders should prioritize upgrading to fixed versions and verify hostname verification settings to prevent malicious or misissued peer certificates from joining quorum traffic.

• Verify and update sslQuorum, zookeeper.fips-mode, ssl.quorum.hostnameVerification, and ssl.quorum.clientHostnameVerification settings to prevent malicious or misissued peer certificates from joining quorum traffic.
• Upgrade to version 3.8.7 or 3.9.6 to fix the issue.
• Review and update hostname verification settings to prevent unauthorized access.

Technical summary

Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When specific configuration settings (sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true) are enabled, the Java SSLSocket quorum path accepts a CA-trusted peer certificate whose SAN does not match the connected host. This issue allows a malicious or misissued peer certificate to join quorum traffic, participate in leader election, and enter replication flows. The vulnerability is addressed in versions 3.8.7 and 3.9.6.

Defensive priority

Defenders should prioritize upgrading to fixed versions and verify hostname verification settings.

Recommended defensive actions

• Upgrade to version 3.8.7 or 3.9.6
• Verify hostname verification settings
• Review and update sslQuorum, zookeeper.fips-mode, ssl.quorum.hostnameVerification, and ssl.quorum.clientHostnameVerification settings
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability and its impact. The issue arises in Apache ZooKeeper quorum TLS deployments where FIPS-mode is enabled, and specific configuration settings lead to a failure in enforcing peer hostname verification. This allows a CA-trusted peer certificate with a non-matching SAN to be accepted, potentially enabling malicious or misissued certificates to join quorum traffic. Users are advised to upgrade to versions 3.8.7 or 3.9.6. Evidence from the CVE record, N

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.