# org.apache.zookeeper:zookeeper (Maven) vulnerabilities 19 known vulnerabilities (2 critical, 7 high, 7 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 3.9.7 (Oct 22, 2026): no advisory affects it - Newest unaffected release: 3.9.7 (Oct 22, 2026), the latest release - Dependents: 175 - Releases: 58 since 3.3.0 (Mar 19, 2010) - Registry: https://central.sonatype.com/artifact/org.apache.zookeeper/zookeeper - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-100302: 3.8.0 to 3.8.7 (3.8.8 is outside it); 3.9.0 to 3.9.6 (3.9.7 is outside it) - CVE-2026-115448: 3.8.0 to 3.8.7 (3.8.8 is outside it); 3.9.0 to 3.9.6 (3.9.7 is outside it) - CVE-2026-100300: 3.8.0 to 3.8.7 (3.8.8 is outside it); 3.9.0 to 3.9.6 (3.9.7 is outside it) - CVE-2026-100252: 3.8.0 to 3.8.7 (3.8.8 is outside it); 3.9.0 to 3.9.6 (3.9.7 is outside it) - CVE-2026-100235: 3.8.0 to 3.8.7 (3.8.8 is outside it); 3.9.0 to 3.9.6 (3.9.7 is outside it) - CVE-2026-84501: 3.8.0 to 3.8.6 (3.8.7 is outside it); 3.9.0 to 3.9.5 (3.9.6 is outside it) - CVE-2026-84439: 3.8.0 to 3.8.6 (3.8.7 is outside it); 3.9.0 to 3.9.5 (3.9.6 is outside it) - CVE-2026-79993: 3.8.0 to 3.8.6 (3.8.7 is outside it); 3.9.0 to 3.9.5 (3.9.6 is outside it) - CVE-2026-59969: 3.8.0 to 3.8.6 (3.8.7 is outside it); 3.9.0 to 3.9.5 (3.9.6 is outside it) - CVE-2026-59739: 3.8.0 to 3.8.6 (3.8.7 is outside it); 3.9.0 to 3.9.5 (3.9.6 is outside it) - CVE-2026-24308: 3.8.0 to 3.8.5 (3.8.6 is outside it); 3.9.0 to 3.9.4 (3.9.5 is outside it) - CVE-2026-24281: 3.8.0 to 3.8.5 (3.8.6 is outside it); 3.9.0 to 3.9.4 (3.9.5 is outside it) - CVE-2025-58457: 3.9.0 to 3.9.3 (3.9.4 is outside it) - CVE-2024-51504: 3.9.0 to 3.9.2 (3.9.3 is outside it) - CVE-2024-23944: 3.6.0 to 3.8.3 (3.8.4 is outside it); 3.9.0 to 3.9.1 (3.9.2 is outside it) - CVE-2023-44981: 3.3.0 to 3.7.1 (3.7.2 is outside it); 3.8.0 to 3.8.2 (3.8.3 is outside it); 3.9.0 (3.9.1 is outside it) - CVE-2019-0201: 3.3.0 to 3.4.13 (3.4.14 is outside it); 3.5.1-alpha to 3.5.4-beta (3.5.5 is outside it) - CVE-2018-8012: 3.3.0 to 3.4.9 (3.4.10 is outside it); 3.5.0-alpha to 3.5.3-beta (3.5.4-beta is outside it) - CVE-2017-5637: 3.4.0 to 3.4.9 (3.4.10 is outside it); 3.5.1-alpha to 3.5.3-beta (3.5.4-beta is outside it) ## Advisories (19) ### [CVE-2026-100302](https://cve.now/CVE-2026-100302): Apache ZooKeeper: Denial of service through unbounded memory allocation in multiRead request handling - Severity: High 7.1 - Published: Nov 4, 2026 - Affected: from 3.9.0, through 3.9.6; from 3.8.0, through 3.8.7. - Fixed in 3.9.7 (released Oct 22, 2026, 13 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 3.9.7, is not affected. ### [CVE-2026-115448](https://cve.now/CVE-2026-115448): Apache ZooKeeper: Unbounded recursion in snapshot serialization allows a client to render the server unrecoverable - Severity: High 8.7 - Published: Nov 4, 2026 - Affected: from 3.9.0, through 3.9.6; from 3.8.0, through 3.8.7. - Fixed in 3.9.7 (released Oct 22, 2026, 13 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 3.9.7, is not affected. ### [CVE-2026-100300](https://cve.now/CVE-2026-100300): Apache ZooKeeper: Unauthenticated persistent denial of service via unvalidated quota-node data and paths crashing the transaction-apply… - Severity: High 8.7 - Published: Nov 4, 2026 - Affected: from 3.9.0, through 3.9.6; from 3.8.0, through 3.8.7. - Fixed in 3.9.7 (released Oct 22, 2026, 13 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 3.9.7, is not affected. ### [CVE-2026-100252](https://cve.now/CVE-2026-100252): Apache ZooKeeper: SASL authorization bypass on the client port through a client-supplied authorization ID - Severity: High 8.6 - Published: Nov 4, 2026 - Affected: from 3.9.0, through 3.9.6; from 3.8.0, through 3.8.7. - Fixed in 3.9.7 (released Oct 22, 2026, 13 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 3.9.7, is not affected. ### [CVE-2026-100235](https://cve.now/CVE-2026-100235): Apache ZooKeeper: ACL enforcement bypass allows unauthorized operations to commit after an ACL revocation - Severity: Medium 6.0 - Published: Nov 4, 2026 - Affected: from 3.9.0, through 3.9.6; from 3.8.0, through 3.8.7. - Fixed in 3.9.7 (released Oct 22, 2026, 13 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 3.9.7, is not affected. ### [CVE-2026-84501](https://cve.now/CVE-2026-84501): Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProvider - Severity: Medium 5.3 - Published: Sep 16, 2026 - Affected: from 3.9.0, through 3.9.5; from 3.8.0, through 3.8.6. - Fixed in 3.9.6 (released Sep 3, 2026, 13 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 3.9.7, is not affected. ### [CVE-2026-84439](https://cve.now/CVE-2026-84439): Apache ZooKeeper: Audit log injection via unsanitized output from multiple sources - Severity: Medium 5.3 - Published: Sep 16, 2026 - Affected: from 3.9.0, through 3.9.5; from 3.8.0, through 3.8.6. - Fixed in 3.9.6 (released Sep 3, 2026, 13 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 3.9.7, is not affected. ### [CVE-2026-79993](https://cve.now/CVE-2026-79993): Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znode - Severity: High 7.5 - Published: Sep 16, 2026 - Affected: from 3.9.0, through 3.9.5; from 3.8.0, through 3.8.6. - Fixed in 3.9.6 (released Sep 3, 2026, 13 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 3.9.7, is not affected. ### [CVE-2026-59969](https://cve.now/CVE-2026-59969): Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode - Severity: High 7.5 - Published: Sep 16, 2026 - Affected: from 3.9.0, through 3.9.5; from 3.8.0, through 3.8.6. - Fixed in 3.9.6 (released Sep 3, 2026, 13 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 3.9.7, is not affected. ### [CVE-2026-59739](https://cve.now/CVE-2026-59739): Apache ZooKeeper: Information disclosure via SetWatches reconnect replay - Severity: High 7.5 - Published: Sep 16, 2026 - Affected: from 3.9.0, through 3.9.5; from 3.8.0, through 3.8.6. - Fixed in 3.9.6 (released Sep 3, 2026, 13 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 3.9.7, is not affected. ### [CVE-2026-24308](https://cve.now/CVE-2026-24308): Apache ZooKeeper: Sensitive information disclosure in client configuration handling - Severity: Medium 6.5 - Published: Mar 7, 2026 - Affected: from 3.9.0, through 3.9.4; from 3.8.0, through 3.8.5; from 3.9.0, fixed in 3.9.5; from 3.8.0, fixed in 3.8.6. - Fixed in 3.8.6 (released Jan 28, 2026, 38 days before disclosure) and 3.9.5 (released Feb 11, 2026, 24 days before disclosure). - The latest release, 3.9.7, is not affected. ### [CVE-2026-24281](https://cve.now/CVE-2026-24281): Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager - Severity: Medium 5.9 - Published: Mar 7, 2026 - Affected: from 3.9.0, through 3.9.4; from 3.8.0, through 3.8.5; from 3.8.0, fixed in 3.8.6; from 3.9.0, fixed in 3.9.5. - Fixed in 3.8.6 (released Jan 28, 2026, 38 days before disclosure) and 3.9.5 (released Feb 11, 2026, 24 days before disclosure). - The latest release, 3.9.7, is not affected. ### [CVE-2025-58457](https://cve.now/CVE-2025-58457): Apache ZooKeeper: Insufficient Permission Check in AdminServer Snapshot/Restore Commands - Severity: Medium 4.3 - Published: Sep 24, 2025 - Affected: from 3.9.0, fixed in 3.9.4; from 3.9.0, fixed in 3.9.4. - Fixed in 3.9.4 (released Aug 19, 2025, 36 days before disclosure). - The latest release, 3.9.7, is not affected. ### [CVE-2024-51504](https://cve.now/CVE-2024-51504): Apache ZooKeeper: Authentication bypass with IP-based authentication in Admin Server - Severity: Critical 9.1 - Published: Nov 7, 2024 - Affected: from 3.9.0, fixed in 3.9.3; from 3.9.0, fixed in 3.9.3. - Fixed in 3.9.3 (released Oct 17, 2024, 21 days before disclosure). - The latest release, 3.9.7, is not affected. ### [CVE-2024-23944](https://cve.now/CVE-2024-23944): Apache ZooKeeper: Information disclosure in persistent watcher handling - Severity: Medium 5.3 - Published: Mar 15, 2024 - Affected: from 3.9.0, through 3.9.1; from 3.8.0, through 3.8.3; from 3.6.0, through 3.7.2; from 3.8.0, fixed in 3.8.4; from 3.9.0, fixed in 3.9.2; from 3.6.0, through 3.7.2. - Fixed in 3.8.4 (released Feb 12, 2024, 32 days before disclosure) and 3.9.2 (released Feb 12, 2024, 32 days before disclosure). - The latest release, 3.9.7, is not affected. ### [CVE-2023-44981](https://cve.now/CVE-2023-44981): Apache ZooKeeper: Authorization bypass in SASL Quorum Peer Authentication - Severity: Critical 9.1 - Published: Oct 11, 2023 - Affected: from 3.9.0, fixed in 3.9.1; from 3.8.0, through 3.8.2; from 3.7.0, through 3.7.1; fixed in 3.7.0; fixed in 3.7.2; from 3.8.0, fixed in 3.8.3; from 3.9.0, fixed in 3.9.1. - Fixed in 3.7.2 (released Oct 6, 2023, 5 days before disclosure), 3.8.3 (released Oct 5, 2023, 6 days before disclosure) and 3.9.1 (released Oct 2, 2023, 9 days before disclosure). - The latest release, 3.9.7, is not affected. ### [CVE-2019-0201](https://cve.now/CVE-2019-0201): An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. - Severity: Unrated - Published: May 23, 2019 - Affected: from 1.0.0, fixed in 3.4.14; from 3.5.0, fixed in 3.5.5. - Fixed in 3.4.14 (released Mar 6, 2019, 78 days before disclosure) and 3.5.5 (released May 3, 2019, 20 days before disclosure). - The latest release, 3.9.7, is not affected. ### [CVE-2018-8012](https://cve.now/CVE-2018-8012): No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha… - Severity: Unrated - Published: May 21, 2018 - Affected: fixed in 3.4.10; from 3.5.0-alpha, fixed in 3.5.4-beta. - Fixed in 3.4.10 (released Mar 23, 2017, 424 days before disclosure) and 3.5.4-beta (released May 11, 2018, 10 days before disclosure). - The latest release, 3.9.7, is not affected. ### [CVE-2017-5637](https://cve.now/CVE-2017-5637): Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused… - Severity: Unrated - Published: Oct 10, 2017 - Affected: from 3.4.0, fixed in 3.4.10; from 3.5.0, fixed in 3.5.3. - Fixed in 3.4.10 (released Mar 23, 2017, 201 days before disclosure) and 3.5.5 (released May 3, 2019, 570 days after disclosure, the advisory names 3.5.3, which was never published). - The latest release, 3.9.7, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/org.apache.zookeeper:zookeeper Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.