---
id: CVE-2026-59969
title: >-
  Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in
  FIPS-mode deployments
summary: "Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true\_are ena…"
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'
cwe:
  - CWE-297
vendor: apache
product: zookeeper
affected:
  - 'zookeeper >= 3.8.0, < 3.8.7'
  - 'zookeeper >= 3.9.0, < 3.9.6'
patched:
  - zookeeper 3.9.6
published: '2026-09-16'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T14:31:23.357'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-59969'
references:
  - url: 'https://lists.apache.org/thread/qf9kwsgtgbgtvwls6f41281846xg0rss'
    label: security@apache.org
  - url: 'http://www.openwall.com/lists/oss-security/2026/09/15/4'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - cve.org
epss: 0.0033
epssPercentile: 0.23299
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-17T19:16:38.006304Z'
ingestedAt: '2026-09-16T09:53:11.604Z'
---

## Overview

Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted peer certificate whose SAN does not match the connected host. A malicious or misissued peer certificate can therefore join quorum traffic, participate in leader election, and enter replication flows.



Users are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.

## Affected

- `zookeeper >= 3.8.0, < 3.8.7`
- `zookeeper >= 3.9.0, < 3.9.6`

## Remediation

Upgrade past the affected range:

- `zookeeper 3.9.6`