1292 matches found
CVE-2026-84501
An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted addauth"ensemble", ... request containing newline characters \n. When the ensemble name doesn't match, EnsembleAuthenticationProvider.handleAuthentication logs the raw,...
UBUNTU-CVE-2026-84501
An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted addauth"ensemble", ... request containing newline characters \n. When the ensemble name doesn't match, EnsembleAuthenticationProvider.handleAuthentication logs the raw,...
Improper Output Neutralization for Logs
Overview org.apache.zookeeper:zookeeper is a centralized service for maintaining configuration information, naming, providing distributed synchronization, and providing group services. Affected versions of this package are vulnerable to Improper Output Neutralization for Logs via the...
Improper Output Neutralization for Logs
Overview org.apache.zookeeper:zookeeper is a centralized service for maintaining configuration information, naming, providing distributed synchronization, and providing group services. Affected versions of this package are vulnerable to Improper Output Neutralization for Logs in the audit logging...
EUVD-2026-80334
An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted addauth"ensemble", ... request containing newline characters \n. When the ensemble name doesn't match, EnsembleAuthenticationProvider.handleAuthentication logs the raw,...
CVE-2026-84501
An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted addauth"ensemble", ... request containing newline characters \n. When the ensemble name doesn't match, EnsembleAuthenticationProvider.handleAuthentication logs the raw,...
CVE-2026-84439 Apache ZooKeeper: Audit log injection via unsanitized output from multiple sources
When audit logging is enabled zookeeper.audit.enable=true, an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sending a digest authentication request with tab characters \t embedded in the username. Because the audit log uses tab-separated key=value forma...
EUVD-2026-80333
When audit logging is enabled zookeeper.audit.enable=true, an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sending a digest authentication request with tab characters \t embedded in the username. Because the audit log uses tab-separated key=value forma...
CVE-2026-84439 Apache ZooKeeper: Audit log injection via unsanitized output from multiple sources
When audit logging is enabled zookeeper.audit.enable=true, an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sending a digest authentication request with tab characters \t embedded in the username. Because the audit log uses tab-separated key=value forma...
CVE-2026-84439 Apache ZooKeeper: Audit log injection via unsanitized output from multiple sources
When audit logging is enabled zookeeper.audit.enable=true, an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sending a digest authentication request with tab characters \t embedded in the username. Because the audit log uses tab-separated key=value forma...
CVE-2026-84439
An unauthenticated attacker can perform a log injection attack on Apache ZooKeeper (versions 3.9.0 through 3.9.5 and 3.8.0 through 3.8.6 ) when audit logging is enabled (zookeeper.audit.enable=true). By sending a digest authentication request containing tab characters ( ) in the username, an atta...
CVE-2026-84439
When audit logging is enabled zookeeper.audit.enable=true, an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sending a digest authentication request with tab characters \t embedded in the username. Because the audit log uses tab-separated key=value forma...
CVE-2026-84501: Improper Output Neutralization for Logs
An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted addauth"ensemble", ... request containing newline characters \n. When the ensemble name doesn't match, EnsembleAuthenticationProvider.handleAuthentication logs the raw,...
PT-2026-93418
Name of the Vulnerable Software and Affected Versions Apache ZooKeeper versions 3.8.0 through 3.8.6 Apache ZooKeeper versions 3.9.0 through 3.9.5 Description An unauthenticated attacker can inject arbitrary fake log lines into the operational log by sending a crafted add auth"ensemble", ... reque...
CVE-2026-84439: Improper Output Neutralization for Logs
When audit logging is enabled zookeeper.audit.enable=true, an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sending a digest authentication request with tab characters \t embedded in the username. Because the audit log uses tab-separated key=value forma...
PT-2026-93417
Name of the Vulnerable Software and Affected Versions Apache ZooKeeper versions 3.9.0 through 3.9.5 Apache ZooKeeper versions 3.8.0 through 3.8.6 Description Log injection occurs when audit logging is enabled via zookeeper.audit.enable=true. An unauthenticated attacker can inject arbitrary fields...
CVE-2026-91986 gitoxide gix-transport before 0.59.2 CR/LF/NUL Injection
gitoxide gix-transport before 0.59.2 fails to filter control characters in git-daemon connect requests, allowing attackers to inject NUL/CR/LF bytes via crafted git URLs. Attackers can inject extra NUL-delimited protocol fields to spoof virtual hosts or inject newlines into daemon requests and lo...
SUSE CVE-2026-87859
morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField function does not escape the double quote character, which delimits the quoted fields of the Apache combined log format that morgan emits. An unauthenticated remote attacker who controls a value...
PT-2026-92100
Name of the Vulnerable Software and Affected Versions gitoxide gix-transport versions prior to 0.59.2 Description The software fails to filter control characters in git-daemon connect requests. This allows attackers to inject NUL, CR, or LF bytes through specially crafted git URLs. Such injection...
