Apache zookeeper: Security fixes for CVE-2026-42583, ghsa-72hv-8253-57qq, ghsa-mj4r-2hfc-f8p6 applied in versions: 3.8.6-r0, 3.8.6-r1
Affects apache-zookeeperSource GCVE Database
Not known to be exploited · fixed in 3.8.6-r1 : update apache-zookeeper when convenient.
Data as of 10/25/2026, 04:40:12 UTC
No CVSS score from NVD or the CNA
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 40% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 3.8.6-r1
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| CleanStartapache-zookeeper | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Security fixes have been applied in Apache Zookeeper versions 3.8.6-r0 and 3.8.6-r1. Users should upgrade to these patched versions to remediate the vulnerabilities. Patch status is confirmed as available.
Description
Multiple security vulnerabilities have been identified in the Apache Zookeeper package, specifically affecting version 3.8.6-r1. These issues involve the Netty network application framework used by Zookeeper. Security fixes addressing CVE-2026-42583 and related vulnerabilities have been applied in versions 3.8.6-r0 and 3.8.6-r1.
Impact
The vulnerabilities could potentially allow attackers to exploit flaws in the network communication framework used by Apache Zookeeper, possibly impacting the security and stability of affected deployments. However, no specific impact details or exploitation reports are available.
References
- github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-YX16662.json (opens in a new tab)
- osv.dev/vulnerability/CVE-2026-42583 (opens in a new tab)
- osv.dev/vulnerability/ghsa-72hv-8253-57qq (opens in a new tab)
- osv.dev/vulnerability/ghsa-mj4r-2hfc-f8p6 (opens in a new tab)
- nvd.nist.gov/vuln/detail/CVE-2026-42583 (opens in a new tab)