A regression in OpenSearch versions 2.18.0 through before 2.19.4.0 and 3.0.0 through before 3.3.0.0 caused the TLS certificate hostname verification setting to be ineffective. When enabled, OpenSearch did not verify that the hostname in a connecting node's TLS certificate matched the connection hostname, allowing nodes with valid certificates but incorrect hostname SANs to join the cluster. This issue affects only the hostname verification step, not the overall certificate validation. The vulnerability is fixed in versions 2.19.4.0 and 3.3.0.0.