CVE-2026-59969 Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode

Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted pe...

EUVD-2026-80330

Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restricted ACLs. Issue is caused by incomplete...

CVE-2026-59739

Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restricted ACLs. Issue is caused by incomplete...

CVE-2026-59739 Apache ZooKeeper: Information disclosure via SetWatches reconnect replay

Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restricted ACLs. Issue is caused by incomplete...

CVE-2026-59739

Apache ZooKeeper is vulnerable to information disclosure due to a missing ACL check in the SetWatches reconnect replay handler. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths and then reconnecting after those paths are created with restricted ACL...

CVE-2026-59739 Apache ZooKeeper: Information disclosure via SetWatches reconnect replay

Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restricted ACLs. Issue is caused by incomplete...

CVE-2026-84501: Improper Output Neutralization for Logs

An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted addauth"ensemble", ... request containing newline characters \n. When the ensemble name doesn't match, EnsembleAuthenticationProvider.handleAuthentication logs the raw,...

PT-2026-93406

Name of the Vulnerable Software and Affected Versions Apache ZooKeeper versions prior to 3.9.6 Apache ZooKeeper versions prior to 3.8.7 Description An information disclosure issue exists due to a missing Access Control List ACL check during the SetWatches reconnect replay. An attacker can discove...

CVE-2026-59739: Missing Authorization

Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restricted ACLs. Issue is caused by incomplete...

CVE-2026-79993: Missing Authorization

The deleteContainer opcode 0x14/20 is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent. This opcode is considered internal-only and the official clie...

CVE-2026-84439: Improper Output Neutralization for Logs

When audit logging is enabled zookeeper.audit.enable=true, an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sending a digest authentication request with tab characters \t embedded in the username. Because the audit log uses tab-separated key=value forma...

CVE-2026-59969: Improper Validation of Certificate with Host Mismatch

Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted pe...

CLEANSTART-2026-ZI25974 In Eclipse Jetty, the HTTP/1

Multiple security vulnerabilities affect the apache-zookeeper package. In Eclipse Jetty, the HTTP/1. See references for individual vulnerability details...

CLEANSTART-2026-BA42566 In Eclipse Jetty, the HTTP/1

Multiple security vulnerabilities affect the apache-zookeeper package. In Eclipse Jetty, the HTTP/1. See references for individual vulnerability details...

CLEANSTART-2026-GH96150 Netty (io

Multiple security vulnerabilities affect the apache-zookeeper package. Netty io. See references for individual vulnerability details...

CLEANSTART-2026-VJ90703 Security fixes for ghsa-72hv-8253-57qq, ghsa-qqpg-mvqg-649v applied in versions: 3.9.4-r0, 3.9.4-r6

Multiple security vulnerabilities affect the apache-zookeeper package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-ZI18123 Security fixes for ghsa-72hv-8253-57qq applied in versions: 3.6.4-r4

Security vulnerability affects the apache-zookeeper package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-PZ89066 In Eclipse Jetty, the HTTP/1

Multiple security vulnerabilities affect the apache-zookeeper package. In Eclipse Jetty, the HTTP/1. See references for individual vulnerability details...

CLEANSTART-2026-LB53225 Netty (io

Multiple security vulnerabilities affect the apache-zookeeper package. Netty io. See references for individual vulnerability details...

CLEANSTART-2026-CX26815 Security fixes in apache-zookeeper 3.8.6-r5

Package apache-zookeeper version 3.8.6-r5 fixes 4 vulnerabilities: ghsa-r7wm-3cxj-wff9, CVE-2026-54515, CVE-2026-59889, ghsa-mhm7-754m-9p8w...