Fluid Attacks Database

Description

Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted peer certificate whose SAN does not match the connected host. A malicious or misissued peer certificate can therefore join quorum traffic, participate in leader election, and enter replication flows. Users are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 12	zookeeper	=3.8.0-11 \|\| =3.8.0-11+deb12u1 \|\| =3.8.0-11+deb12u2 \|\| =3.9.1-1 \|\| =3.9.2-1 \|\| =3.9.2-2 \|\| =3.9.3-1 \|\| =3.9.3-2 \|\| =3.9.4-1 \|\| =3.9.4-2 \|\| =3.9.5-1 \|\| =3.9.5-2 \|\| =3.9.6-1	-
debian 13	zookeeper	=3.9.3-1 \|\| =3.9.3-1+deb13u1 \|\| =3.9.3-2 \|\| =3.9.4-1 \|\| =3.9.4-2 \|\| =3.9.5-1 \|\| =3.9.5-2 \|\| =3.9.6-1	-
debian 14	zookeeper	=3.9.3-1 \|\| =3.9.3-2 \|\| =3.9.4-1 \|\| =3.9.4-2 \|\| =3.9.5-1 \|\| =3.9.5-2 \|\| >=0 <3.9.6-1	3.9.6-1

Aliases

1. CVE-2026-599692. NVD-2026-599693. OSV-DEBIAN-2026-599694. OSV-2026-599695. SECURITY-TRACKER-CVE-2026-59969

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.