Not rated
CVE-2026-24308 Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an…
Description
Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat AMQ Broker 7.12.7 | Versions not published | |
| Red Hat AMQ Broker 7.13.5 | Versions not published | |
| Red Hat AMQ Broker 7.14.0 | Versions not published | |
| Red Hat OpenShift AI 2.25 1776756834 | earliest → < 1776756834 | 1776756834 |
| Red Hat build of Debezium 2 | Versions not published | |
| Red Hat build of Debezium 3 | Versions not published | |
| Red Hat Fuse 7 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform 7 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Versions not published |
Show the 10 other branches Hide the 10 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Offline Knowledge Portal | Versions not published | |
| Red Hat OpenShift AI (RHOAI) | Versions not published | |
| streams for Apache Kafka 2 | Versions not published | |
| streams for Apache Kafka 3 | Versions not published | |
| Red Hat build of Apache Camel for Spring Boot 4 | Versions not published | |
| Red Hat Data Grid 8 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform 8 | Versions not published | |
| Apache ZooKeeper 3.9 | 3.9.0 → 3.9.4 | No fix stated |
| Apache ZooKeeper 3.8 | 3.8.0 → 3.8.5 | No fix stated |
| Streams for Apache Kafka 2.9.4 | Versions not published |
References
- lists.apache.org lists.apache.org
Timeline
- Published
- Last modified
Other CVEs of Red Hat AMQ Broker 7.12.7
The 7 CVEs of Red Hat AMQ Broker 7.12.7 →
CVE-2026-5588
Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc
6.3
Medium
CVE-2026-0636
Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the…
5.5
Medium
CVE-2025-14813
: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc
9.3
Critical
CVE-2026-33871
Netty is an asynchronous, event-driven network application framework
8.7
High