Threats affecting pkg:maven/org.apache.zookeeper/zookeeper

CVE-2026-84439 is a log injection vulnerability in Apache ZooKeeper affecting versions 3.8.0 through 3.8.6 and 3.9.0 through 3.9.5. When audit logging is enabled, an unauthenticated attacker can inject arbitrary fields into the audit log by sending digest authentication requests with tab characters in the username. This allows the attacker to forge audit log entries, potentially misleading forensic analysis and incident response. The issue is fixed in versions 3.8.7 and 3.9.6.

Apache ZooKeeper versions 3.8.0 through 3.8.6 and 3.9.0 through 3.9.5 contain an authorization bypass vulnerability in the handling of the internal-only deleteContainer opcode. This flaw allows any client able to open a TCP connection to the ZooKeeper client port to delete empty persistent znodes without proper ACL checks or authentication. The issue is fixed in versions 3.8.7 and 3.9.6.

Apache ZooKeeper versions 3.8.0 through 3.8.6 and 3.9.0 through 3.9.5 have a vulnerability in quorum TLS where peer hostname verification is improperly enforced in FIPS-mode deployments. This allows a CA-trusted peer certificate with a Subject Alternative Name (SAN) that does not match the connected host to join quorum traffic, participate in leader election, and enter replication flows. The issue is fixed in versions 3.8.7 and 3.9.6.

An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble", ...) request containing newline characters (\n). When the ensemble name doesn't match, EnsembleAuthenticationProvider.handleAuthentication() logs the raw, unsanitized name via LOG.warn(). Because SLF4J's {} placeholder preserves embedded newlines, the attacker can forge complete log entries — with arbitrary timestamps, log levels, class names, and messages — that are visually indistinguishable from genuine ZooKeeper log output. This issue affects Apache ZooKeeper: from 3.9.0 through 3.9.5, from 3.8.0 through 3.8.6. Users are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.

CVE-2026-59739 is a missing authorization vulnerability in Apache ZooKeeper that allows information disclosure of ACL-restricted paths. An attacker can register exists-watches on non-existent paths and then reconnect after those paths are created with restricted ACLs, thereby discovering the paths. The vulnerability arises from an incomplete fix for a previous issue, where ACL checks were not applied during the SetWatches reconnect replay handler. Although the data of the znode is not exposed, the path itself may contain sensitive information such as usernames or login IDs. The issue affects Apache ZooKeeper versions 3.8.0 through 3.8.6 and 3.9.0 through 3.9.5. Upgrading to versions 3.8.7 or 3.9.6 resolves the vulnerability.

Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.

Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.