Apache Software Foundation Apache ZooKeeper vulnerabilities

16 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 9 published in the last 12 months.

Latest Apache Software Foundation Apache ZooKeeper vulnerabilities

CVE-2026-84501 — Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProvider (CVSS 5.3)
CVE-2026-84439 — Apache ZooKeeper: Audit log injection via unsanitized output from multiple sources (CVSS 5.3)
CVE-2026-79993 — Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znode (CVSS 7.5)
CVE-2026-59969 — Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode (CVSS 7.5)
CVE-2026-59739 — Apache ZooKeeper: Information disclosure via SetWatches reconnect replay (CVSS 7.5)
CVE-2026-24308 — Apache ZooKeeper: Sensitive information disclosure in client configuration handling (CVSS 7.5)
CVE-2026-24281 — Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager (CVSS 7.4)
CVE-2025-58457 — Apache ZooKeeper: Insufficient Permission Check in AdminServer Snapshot/Restore Commands (CVSS 4.3)
CVE-2024-51504 — Apache ZooKeeper: Authentication bypass with IP-based authentication in Admin Server (CVSS 9.1)
CVE-2024-23944 — Apache ZooKeeper: Information disclosure in persistent watcher handling (CVSS 5.3)
CVE-2023-44981 — Apache ZooKeeper: Authorization bypass in SASL Quorum Peer Authentication (CVSS 9.1)
CVE-2021-21295 — Possible request smuggling in HTTP/2 due missing validation (CVSS 5.9)
CVE-2019-0201 — (CVSS 5.9)
CVE-2018-8012 — (CVSS 7.5)
CVE-2017-5637 — (CVSS 7.5)
CVE-2016-5017 — (CVSS 8.1)