Skip to content
VulniPulse
Sign in
Highest advisory severityCritical 2 vendors · 2 advisories

CVE-2026-59969

CVE-2026-59969: 2 tracked advisory records across Apache, Red Hat. Compare vendor sources and published fix guidance.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

Vendor advisory comparison

Apache

1 advisory
  • Advisory severityHigh7.5

    High [CVE-2026-59969] Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments

    CVE-2026-59969Source published Source updated

    Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted peer certificate whose SAN does not match the connected host. A malicious or misissued peer certificate can therefore join quorum traffic, participate in leader election, and enter replication flows. Users are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.

    Related products — impact not confirmed
    • Apache ZooKeeper
    Source-reported affected versions
    • Apache ZooKeeper 3.9.0 through 3.9.5
    • Apache ZooKeeper 3.8.0 through 3.8.6
    Source-reported fixed versions
    • 3.8.7
    • 3.9.6
    Mitigation guidance
    • Users are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.
    Full advisory and evidenceOpen source bulletin

Red Hat

1 advisory
  • Advisory severityCritical9.0

    Critical [CVE-2026-59969] Improper certificate validation in FIPS mode allows quorum compromise

    CVE-2026-59969Source published Source updated

    Improper certificate validation in FIPS mode allows quorum compromise. Red Hat rates this important (CVSS 9). Weakness: CWE-295. Affected products named by the advisory: Red Hat AMQ Broker 7; Red Hat build of Apache Camel for Spring Boot 4; Red Hat JBoss Enterprise Application Platform 8; Red Hat JBoss Enterprise Application Platform Expansion Pack; and 2 more.

    Related products — impact not confirmed
    • Red Hat AMQ Broker 7
    • Red Hat build of Apache Camel for Spring Boot 4
    • Red Hat JBoss Enterprise Application Platform 8
    • Red Hat JBoss Enterprise Application Platform Expansion Pack

    2 more entries in the full advisory.

    Source-reported affected versions
    Affected-version details not available in this record.
    Source-reported fixed versions
    • 3.8.7
    • 3.9.6
    Mitigation guidance
    • Update to Apache ZooKeeper 3.8.7, 3.9.6, or later. As a workaround, disable FIPS mode if not required by compliance policies.
    Full advisory and evidenceOpen source bulletin

Android app · Google Play

Turn CVE research into alerts on your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features