Affected: Apache Software Foundation Apache ZooKeeper, Red Hat AMQ Broker 7.12.7, Red Hat AMQ Broker 7.13.5, Red Hat AMQ Broker 7.14.0, Red Hat Streams for Apache Kafka 2.9.4, Red Hat OpenShift AI 2.25, Red Hat build of Apache Camel for Spring Boot 4, Red Hat build of Debezium 2, Red Hat build of Debezium 3, Red Hat Data Grid 8 and 7 more

Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.

Affected: Maven: io.netty:netty-handler

### Summary An attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions.

### Details `io.netty.handler.ipfilter.IpSubnetFilterRule#compareTo(java.net.InetSocketAddress)` method performs a bitwise AND between the incoming IP address and the configured networkAddress, instead of the subnetMask.

### Impact Access Control Bypass. Attacker can bypass IpSubnetFilter IPv6 access controls.