CVE-2026-100235

A time-of-check to time-of-use (TOCTOU) race condition exists in the setACL request handling of Apache ZooKeeper (up to and including version 3.9.6 ). When an ACL is changed, pending changes are not published to the server's outstanding change record. This allows a client to perform operations us...

EUVD-2026-116866

Incorrect authorization due to a time-of-check to time-of-use TOCTOU race condition in the setACL request handling of Apache ZooKeeper. When a node's ACL is changed via setACL, the pending change is not published to the server's outstanding change record for that node. Any request that is prepare...