| CVE-2026-100302 |
Apache ZooKeeper: Denial of service through unbounded memory allocation in multiRead request handling
|
7.1
High
|
Nov 4, 2026 |
| CVE-2026-115448 |
Apache ZooKeeper: Unbounded recursion in snapshot serialization allows a client to render the server unrecoverable
|
8.7
High
|
Nov 4, 2026 |
| CVE-2026-100300 |
Apache ZooKeeper: Unauthenticated persistent denial of service via unvalidated quota-node data and paths crashing the transaction-apply thread
|
8.7
High
|
Nov 4, 2026 |
| CVE-2026-100252 |
Apache ZooKeeper: SASL authorization bypass on the client port through a client-supplied authorization ID
|
8.6
High
|
Nov 4, 2026 |
| CVE-2026-100235 |
Apache ZooKeeper: ACL enforcement bypass allows unauthorized operations to commit after an ACL revocation
|
6.0
Medium
|
Nov 4, 2026 |
| CVE-2026-84501 |
An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a…
|
Not rated
|
Sep 16, 2026 |
| CVE-2026-84439 |
When audit logging is enabled (zookeeper.audit.enable=true), an unauthenticated attacker can inject arbitrary fields…
|
Not rated
|
Sep 16, 2026 |
| CVE-2026-79993 |
The `deleteContainer` opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any…
|
Not rated
|
Sep 16, 2026 |
| CVE-2026-59969 |
Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments
|
Not rated
|
Sep 16, 2026 |
| CVE-2026-59739 |
Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can…
|
Not rated
|
Sep 16, 2026 |
| CVE-2026-24308 |
Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an…
|
Not rated
|
Mar 7, 2026 |
| CVE-2026-24281 |
Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails,…
|
Not rated
|
Mar 7, 2026 |
| CVE-2025-58457 |
Improper permission check in ZooKeeper AdminServer lets authorized clients to run snapshot and restore command with…
|
Not rated
|
Sep 24, 2025 |
| CVE-2024-51504 |
When using IPAuthenticationProvider in ZooKeeper Admin Server there is a possibility of Authentication Bypass by…
|
Not rated
|
Nov 7, 2024 |
| CVE-2024-23944 |
Information disclosure in persistent watchers handling in Apache ZooKeeper due to missing ACL check
|
Not rated
|
Mar 15, 2024 |
| CVE-2023-44981 |
Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper
|
Not rated
|
Oct 11, 2023 |
| CVE-2019-0201 |
An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta
|
Not rated
|
May 23, 2019 |
| CVE-2018-8012 |
No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10,…
|
Not rated
|
May 21, 2018 |
| CVE-2017-5637 |
Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper…
|
Not rated
|
Oct 10, 2017 |