Zookeeper (Apache) - vulnerabilities (CVEs)
16 CVEs, 0 in the last 30 days, 167 known versions, newest CVE from 2026-09-16. Vendor: Apache.
CVEs of Zookeeper
- CVE-2026-84501 - CVSS 5.3 (medium), 2026-09-16: An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble", ...) request…
- CVE-2026-84439 - CVSS 5.3 (medium), 2026-09-16: When audit logging is enabled (zookeeper.audit.enable=true), an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by…
- CVE-2026-79993 - CVSS 7.5 (high), 2026-09-16: The `deleteContainer` opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific…
- CVE-2026-59969 - CVSS 7.5 (high), 2026-09-16: Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true,…
- CVE-2026-59739 - CVSS 7.5 (high), 2026-09-16: Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by…
- CVE-2026-24308 - CVSS 7.5 (high), 2026-03-07: Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information…
- CVE-2026-24281 - CVSS 7.4 (high), 2026-03-07: Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof…
- CVE-2025-58457 - CVSS 4.3 (medium), 2025-09-24: Improper permission check in ZooKeeper AdminServer lets authorized clients to run snapshot and restore command with insufficient permissions. This issue…
- CVE-2024-51504 - CVSS 9.1 (critical), 2024-11-07: When using IPAuthenticationProvider in ZooKeeper Admin Server there is a possibility of Authentication Bypass by Spoofing -- this only impacts IP based…
- CVE-2024-23944 - CVSS 5.3 (medium), 2024-03-15: Information disclosure in persistent watchers handling in Apache ZooKeeper due to missing ACL check. It allows an attacker to monitor child znodes by…
- CVE-2023-44981 - CVSS 9.1 (critical), 2023-10-11: Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper. If SASL Quorum Peer authentication is enabled in ZooKeeper…
- CVE-2021-21295 - CVSS 5.9 (medium), 2021-03-09: Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers &…
- CVE-2019-0201 - CVSS 5.9 (medium), 2019-05-23: An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when…
- CVE-2018-8012 - CVSS 7.5 (high), 2018-05-21: No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As…
- CVE-2017-5637 - CVSS 7.5 (high), 2017-10-10: Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads to the…
- CVE-2016-5017 - CVSS 8.1 (high), 2016-09-21: Buffer overflow in the C cli shell in Apache Zookeeper before 3.4.9 and 3.5.x before 3.5.3, when using the "cmd:" batch mode syntax, allows attackers to have…
