Apache ZooKeeper: Apache ZooKeeper: Information disclosure via improper handling of configuration values

A flaw was found in Apache ZooKeeper. Improper handling of configuration values in ZKConfig allows an attacker to expose sensitive information. This occurs when sensitive client configuration values are logged at an INFO level in the client's logfile. This vulnerability can lead to information...

GHSA-47QP-HQVX-6R3F vulnerabilities

Vulnerabilities for packages: hadoop-fips, apache-pulsar-fips, tez, apache-nifi, kafka, zookeeper-fips, kafka-fips, hadoop-client-modules, apache-pulsar, confluent-kafka-jre-bcfips, spark-kubernetes-operator-fips, pinot, apache-camel-karavan-devmode, druid, spark, apache-hop-fips, spark-fips,...

GHSA-2R2C-CX56-8933 vulnerabilities

Vulnerabilities for packages: hadoop-fips, apache-pulsar-fips, tez, apache-nifi, kafka, zookeeper-fips, kafka-fips, hadoop-client-modules, apache-pulsar, confluent-kafka-jre-bcfips, spark-kubernetes-operator-fips, pinot, apache-camel-karavan-devmode, druid, spark, apache-hop-fips, spark-fips,...

Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Apache ZooKeeper

Summary Multiple vulnerabilities in Apache ZooKeeper that is used by InfoSphere Information Server were addressed. Vulnerability Details CVEID:CVE-2026-24281 DESCRIPTION: Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS PTR when IP SAN validation fails, allowing...

CVE-2026-11746

A vulnerability has been identified in centraldogma-server versions prior to 0.84.0, where enabling ZooKeeper replication without setting replication.secret causes the server to silently fall back to a hard-coded, publicly known secret. This default credential authenticates the embedded ZooKeeper...

CVE-2026-11746

CVE-2026-11746 affects centraldogma-server versions prior to 0.84.0. If ZooKeeper replication is enabled without setting replication.secret, the server falls back to a hard-coded, publicly known secret that authenticates the embedded ZooKeeper ensemble. This allows an attacker with network access...

CVE-2026-11746

A vulnerability has been identified in centraldogma-server versions prior to 0.84.0, where enabling ZooKeeper replication without setting replication.secret causes the server to silently fall back to a hard-coded, publicly known secret. This default credential authenticates the embedded ZooKeeper...

EUVD-2026-38207

A vulnerability has been identified in centraldogma-server versions prior to 0.84.0, where enabling ZooKeeper replication without setting replication.secret causes the server to silently fall back to a hard-coded, publicly known secret. This default credential authenticates the embedded ZooKeeper...

ROOT-APP-MAVEN-CVE-2025-58457 CVE-2025-58457 in io.root.org.apache.zookeeper:zookeeper - Patched by Root

Root has patched CVE-2025-58457 in the io.root.org.apache.zookeeper:zookeeper package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-24308 CVE-2026-24308 in io.root.org.apache.zookeeper:zookeeper - Patched by Root

Root has patched CVE-2026-24308 in the io.root.org.apache.zookeeper:zookeeper package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2024-23944 CVE-2024-23944 in io.root.org.apache.zookeeper:zookeeper - Patched by Root

Root has patched CVE-2024-23944 in the io.root.org.apache.zookeeper:zookeeper package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2024-51504 CVE-2024-51504 in io.root.org.apache.zookeeper:zookeeper - Patched by Root

Root has patched CVE-2024-51504 in the io.root.org.apache.zookeeper:zookeeper package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-24281 CVE-2026-24281 in io.root.org.apache.zookeeper:zookeeper - Patched by Root

Root has patched CVE-2026-24281 in the io.root.org.apache.zookeeper:zookeeper package for Root:Maven. Multiple fixed versions available...

CLEANSTART-2026-AO11810 Netty is an asynchronous, event-driven network application framework

Multiple security vulnerabilities affect the apache-zookeeper package. Netty is an asynchronous, event-driven network application framework. See references for individual vulnerability details...

CLEANSTART-2026-HW72470 Security fixes for ghsa-72hv-8253-57qq applied in versions: 3.6.4-r4

Security vulnerability affects the apache-zookeeper package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-CC73064 In Eclipse Jetty, the HTTP/1

Multiple security vulnerabilities affect the apache-zookeeper package. In Eclipse Jetty, the HTTP/1. See references for individual vulnerability details...

CLEANSTART-2026-YM13650 Netty is an asynchronous, event-driven network application framework

Multiple security vulnerabilities affect the apache-zookeeper package. Netty is an asynchronous, event-driven network application framework. See references for individual vulnerability details...

CLEANSTART-2026-GB30250 Security fixes for ghsa-72hv-8253-57qq, ghsa-qqpg-mvqg-649v applied in versions: 3.9.4-r0, 3.9.4-r6

Multiple security vulnerabilities affect the apache-zookeeper package. These issues are resolved in later releases. See references for individual vulnerability details...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data. The Kryo-based persistence serializers KryoStateMachineSerialisationService / AbstractKryoStateMachineSerialisationService deserialise persisted state-machine contexts without enabling...

CLEANSTART-2026-VG07087 In Eclipse Jetty, the HTTP/1

Multiple security vulnerabilities affect the apache-zookeeper package. In Eclipse Jetty, the HTTP/1. See references for individual vulnerability details...