CVE-2026-79993

A flaw was found in Apache ZooKeeper. The deleteContainer opcode is processed without verifying Access Control List ACL permissions. A remote, unauthenticated attacker with network access to the ZooKeeper client port can delete any empty persistent znode, including container and TTL nodes. This c...

dubbo-rce

CVE-2023-23638 학습 및 연구 목적으로만 제공 ZooKeeper는 별도로 준비 필요 테스트 환경은 Java 8이며, 다른 버전은 테스트되지 않았고, 사용 가능성을 보장하지 않습니다. 재현 시 DemoConsumer에 VM 매개변수를 추가해야 합니다: -Ddubbo.hessian.allowNonSerializable=true, 자세한 내용은 https://su18.org/post/hessian/serializable를 참조하세요. 분석 글:...

CLEANSTART-2026-YK34202 Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check

CVE-2026-59739 affects multiple packages. Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. See references for individual vulnerability details...

CLEANSTART-2026-XH38250 Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments

CVE-2026-59969 affects multiple packages. Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. See references for individual vulnerability details...

CLEANSTART-2026-WQ92257 When audit logging is enabled (zookeeper

CVE-2026-84439 affects multiple packages. When audit logging is enabled zookeeper. See references for individual vulnerability details...

CLEANSTART-2026-ZA11117 unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble",

CVE-2026-84501 affects multiple packages. An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted addauth"ensemble",. See references for individual vulnerability details...

dubbo-CVE-2023-23638

CVE-2023-23638 学習研究目的のみ ZooKeeper はご自身でご用意ください テスト環境は Java 8 です。他のバージョンは未テストであり、動作を保証しません。 再現時には、DemoConsumer に VM パラメータ -Ddubbo.hessian.allowNonSerializable=true を追加する必要があります。詳細は https://su18.org/post/hessian/serializable を参照してください。 分析記事:...

CLEANSTART-2026-QQ07895 unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble",

Security vulnerability affects the spark package. An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted addauth"ensemble",...

CLEANSTART-2026-JQ32755 Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments

Security vulnerability affects the spark package. Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments...

CLEANSTART-2026-JM28284 Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check

Security vulnerability affects the spark package. Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check...

Apache Curator 5.9.0 Java Deserialization

Summary Apache Curator is a Java/JVM client library for Apache ZooKeeper, a distributed coordination service. It includes a high level API framework and utilities to make using Apache ZooKeeper much easier and more reliable. It also includes recipes for common use cases and extensions such as...

CVE-2014-085

CVE-2014-085 ZooKeeper 未授权访问漏洞（CVE-2014-085）PoC および標的環境 usage ./nuclei -duc -t zookeeper-unauth.yaml -u ip...

Security Bulletin: Multiple Vulnerabilities in IBM Concert Operate / IBM Cloud Pak for AIOps

Summary Multiple vulnerabilities were addressed in IBM Concert Operate version 5.2.0 Vulnerability Details CVEID:CVE-2026-24281 DESCRIPTION: Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS PTR when IP SAN validation fails, allowing attackers who control or spoof...

CVE-2026-68497 vulnerabilities

Vulnerabilities for packages: wildfly, flyway, celeborn, strimzi-kafka-oauth, akhq, zookeeper, apicurio-registry, sonarqube, jenkins-plugin-manager, ruby3.4-jrjackson, kafka, gradle, kserve-modelmesh, opensearch, ruby3.2-jrjackson, dependency-track, ruby4.0-jrjackson, thingsboard,...

CVE-2026-83557 vulnerabilities

Vulnerabilities for packages: wildfly, flyway, celeborn, strimzi-kafka-oauth, akhq, zookeeper, apicurio-registry, sonarqube, jenkins-plugin-manager, ruby3.4-jrjackson, kafka, gradle, kserve-modelmesh, opensearch, ruby3.2-jrjackson, dependency-track, ruby4.0-jrjackson, thingsboard,...

CVE-2026-19032 vulnerabilities

Vulnerabilities for packages: wildfly, flyway, celeborn, strimzi-kafka-oauth, akhq, zookeeper, apicurio-registry, sonarqube, jenkins-plugin-manager, ruby3.4-jrjackson, kafka, gradle, kserve-modelmesh, opensearch, ruby3.2-jrjackson, dependency-track, ruby4.0-jrjackson, thingsboard,...

GHSA-Q4XH-88C3-WMH7 vulnerabilities

Vulnerabilities for packages: wildfly, flyway, celeborn, strimzi-kafka-oauth, akhq, zookeeper, apicurio-registry, sonarqube, jenkins-plugin-manager, ruby3.4-jrjackson, kafka, gradle, kserve-modelmesh, opensearch, ruby3.2-jrjackson, dependency-track, ruby4.0-jrjackson, thingsboard,...

GHSA-WJGM-6HV5-3CVF vulnerabilities

Vulnerabilities for packages: wildfly, flyway, celeborn, strimzi-kafka-oauth, akhq, zookeeper, apicurio-registry, sonarqube, jenkins-plugin-manager, ruby3.4-jrjackson, kafka, gradle, kserve-modelmesh, opensearch, ruby3.2-jrjackson, dependency-track, ruby4.0-jrjackson, thingsboard,...

GHSA-GX83-3VF8-GH7J vulnerabilities

Vulnerabilities for packages: wildfly, flyway, celeborn, strimzi-kafka-oauth, akhq, zookeeper, apicurio-registry, sonarqube, jenkins-plugin-manager, ruby3.4-jrjackson, kafka, gradle, kserve-modelmesh, opensearch, ruby3.2-jrjackson, dependency-track, ruby4.0-jrjackson, thingsboard,...

CLEANSTART-2026-KR26174 unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble",

Security vulnerability affects the apache-hive package. An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted addauth"ensemble",...