Threats Tagged 'ghsa-mxvw-9w3g-hmrq'

CVE-2026-84439 is a log injection vulnerability in Apache ZooKeeper affecting versions 3.8.0 through 3.8.6 and 3.9.0 through 3.9.5. When audit logging is enabled, an unauthenticated attacker can inject arbitrary fields into the audit log by sending digest authentication requests with tab characters in the username. This allows the attacker to forge audit log entries, potentially misleading forensic analysis and incident response. The issue is fixed in versions 3.8.7 and 3.9.6.