CVE-2026-24281

Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS PTR when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must...

Apache Zookeeper 安全漏洞

Apache Zookeeper is a software project of the Apache Foundation in the United States. It provides open-source distributed configuration services, synchronization services, and naming and registration functions for large-scale distributed computing systems. Versions 3.8.5 and 3.9.4 of Apache...

Apache Zookeeper 安全漏洞

Apache Zookeeper is a software project of the Apache Foundation in the United States. It provides open-source distributed configuration services, synchronization services, and naming registration capabilities for large-scale distributed computing systems. There is a security vulnerability in Apac...

Security Bulletin: Improper Permission Check in Apache ZooKeeper AdminServer Allows Unauthorized Snapshot and Restore Operations, affects watsonx.data

Summary Improper permission check in ZooKeeper AdminServer lets authorized clients to run snapshot and restore command with insufficient permissions. This issue affects Apache ZooKeeper: from 3.9.0 before 3.9.4. Users are recommended to upgrade to version 3.9.4, which fixes the issue. The issue c...

Improper Validation of Array Index

Overview Affected versions of this package are vulnerable to Improper Validation of Array Index in the Graphite or Zookeeper server metricsets and the Prometheus helper module. An attacker can cause a service disruption by sending specially crafted, malformed payloads or metric data. Remediation...

Improper Validation of Array Index

Overview Affected versions of this package are vulnerable to Improper Validation of Array Index in the Graphite or Zookeeper server metricsets and the Prometheus helper module. An attacker can cause a service disruption by sending specially crafted, malformed payloads or metric data. Remediation...

GHSA-W2GR-585J-R428 Metricbeat affected by multiple denial of service vulnerabilities

Improper Validation of Array Index CWE-129 exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Manipulation CAPEC-153 via specially crafted, malformed payloads sent to the Graphite server metricset or Zookeeper server metricset. Additionally, Improper Input...

Metricbeat affected by multiple denial of service vulnerabilities

Improper Validation of Array Index CWE-129 exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Manipulation CAPEC-153 via specially crafted, malformed payloads sent to the Graphite server metricset or Zookeeper server metricset. Additionally, Improper Input...

CVE-2026-0528

Improper Validation of Array Index CWE-129 exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Manipulation CAPEC-153 via specially crafted, malformed payloads sent to the Graphite server metricset or Zookeeper server metricset. Additionally, Improper Input...

CVE-2026-0528 Improper Input Validation in Metricbeat Leading to Denial of Service

Improper Validation of Array Index CWE-129 exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Manipulation CAPEC-153 via specially crafted, malformed payloads sent to the Graphite server metricset or Zookeeper server metricset. Additionally, Improper Input...

EUVD-2026-2032

Improper Validation of Array Index CWE-129 exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Manipulation CAPEC-153 via specially crafted, malformed payloads sent to the Graphite server metricset or Zookeeper server metricset. Additionally, Improper Input...

CVE-2026-0528 Improper Input Validation in Metricbeat Leading to Denial of Service

Improper Validation of Array Index CWE-129 exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Manipulation CAPEC-153 via specially crafted, malformed payloads sent to the Graphite server metricset or Zookeeper server metricset. Additionally, Improper Input...

CVE-2026-0528

CVE-2026-0528 affects Elastic Beats (Metricbeat) and related metricsets. The root cause is improper validation of array index (CWE-129) in the Graphite and Zookeeper metricsets and improper input validation (CWE-20) in the Prometheus helper module, leading to Denial of Service via specially craft...

CVE-2026-0528 Improper Input Validation in Metricbeat Leading to Denial of Service

Improper Validation of Array Index CWE-129 exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Manipulation CAPEC-153 via specially crafted, malformed payloads sent to the Graphite server metricset or Zookeeper server metricset. Additionally, Improper Input...

Metricbeat 8.19.10, 9.1.10, 9.2.4 Security Update (ESA-2026-01)

Improper Input Validation in Metricbeat Leading to Denial of Service ESA-2026-01 Improper Validation of Array Index CWE-129 exists in Metricbeat can allow an attacker to cause a Denial of Service via Input Data Manipulation CAPEC-153 using specially crafted, malformed payloads sent to the Graphit...

PT-2026-2632

Name of the Vulnerable Software and Affected Versions Metricbeat affected versions not specified Description The software contains flaws related to improper validation of array indices and improper input validation. These issues can be exploited through specially crafted, malformed payloads sent ...

Security Bulletin: IBM SPSS Analytic Server is affected by multiple vulnerabilities in zookeeper (CVE-2018-8012, CVE-2019-0201, CVE-2023-44981, CVE-2017-5637)

Summary IBM SPSS Analytic Server is affected by multiple vulnerabilities in zookeeper CVE-2018-8012, CVE-2019-0201, CVE-2023-44981, CVE-2017-5637. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2018-8012 DESCRIPTION: No authentication/authorization is enforced...

PT-2026-23853

Name of the Vulnerable Software and Affected Versions Apache ZooKeeper versions 3.8.5 and 3.9.4 Description An issue exists in Apache ZooKeeper where improper handling of configuration values in ZKConfig can lead to the exposure of sensitive information. Specifically, client configuration data...

PT-2026-23852

Name of the Vulnerable Software and Affected Versions Apache ZooKeeper versions prior to 3.8.6 Apache ZooKeeper versions prior to 3.9.5 Description A flaw exists in the hostname verification process within Apache ZooKeeper’s ZKTrustManager. When IP Subject Alternative Name SAN validation fails, t...

ROS-20251223-7314

A vulnerability in the Snapshot/Restore commands of the AdminServer component of the centralized service for maintaining configuration information, naming, providing distributed synchronization, and provisioning Apache ZooKeeper group services is related to incorrect handling of insufficient...