Apache Software Foundation Apache ZooKeeper
14 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-84501 | 3.9.0 – 3.9.5 ; 3.8.0 – 3.8.6 | Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProvider | MEDIUM 5.3 | 0.7 % | ||
| CVE-2026-84439 | 3.9.0 – 3.9.5 ; 3.8.0 – 3.8.6 | Apache ZooKeeper: Audit log injection via unsanitized output from multiple sources | MEDIUM 5.3 | 0.7 % | ||
| CVE-2026-79993 | 3.9.0 – 3.9.5 ; 3.8.0 – 3.8.6 | Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znode | HIGH 7.5 | 0.6 % | ||
| CVE-2026-59969 | 3.9.0 – 3.9.5 ; 3.8.0 – 3.8.6 | Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode | HIGH 7.5 | 0.3 % | ||
| CVE-2026-59739 | 3.9.0 – 3.9.5 ; 3.8.0 – 3.8.6 | Apache ZooKeeper: Information disclosure via SetWatches reconnect replay | HIGH 7.5 | 0.6 % | ||
| CVE-2026-24308 | 3.9.0 – 3.9.4 ; 3.8.0 – 3.8.5 | Apache ZooKeeper: Sensitive information disclosure in client configuration handling | HIGH 7.5 | 1.2 % | ||
| CVE-2026-24281 | 3.9.0 – 3.9.4 ; 3.8.0 – 3.8.5 | Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager | HIGH 7.4 | 0.6 % | ||
| CVE-2025-58457 | 3.9.0 – < 3.9.4 | Apache ZooKeeper: Insufficient Permission Check in AdminServer Snapshot/Restore Commands | MEDIUM 4.3 | 0.3 % | ||
| CVE-2024-51504 | 3.9.0 – < 3.9.3 | Apache ZooKeeper: Authentication bypass with IP-based authentication in Admin Server | CRITICAL 9.1 | 0.9 % | ||
| CVE-2024-23944 | 3.9.0 – 3.9.1 ; 3.8.0 – 3.8.3 ; 3.6.0 – 3.7.2 | Apache ZooKeeper: Information disclosure in persistent watcher handling | MEDIUM 5.3 | 0.2 % | ||
| CVE-2023-44981 | 3.9.0 – < 3.9.1 ; 3.8.0 – 3.8.2 ; 3.7.0 – 3.7.1 ; … | Apache ZooKeeper: Authorization bypass in SASL Quorum Peer Authentication | CRITICAL 9.1 | 2.2 % | ||
| CVE-2019-0201 | 1.0.0 to 3.4.13 ; 3.5.0-alpha to 3.5.4-beta | An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permis | MEDIUM 5.9 | 9.7 % | ||
| CVE-2018-8012 | Apache ZooKeeper prior to 3.4.10, Apache ZooKeeper 3.5.0-alpha through 3.5.3-beta | No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha throu | HIGH 7.5 | 8.5 % | ||
| CVE-2017-5637 | 3.4.0 to 3.4.9 ; 3.5.0 to 3.5.2 | Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, w | HIGH 7.5 | 73 % |