Access control bypass in Apache ZooKeeper

Description

Affected products

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Affected packages

Advisories 7

• USN-6559-1 zookeeper vulnerabilities Ubuntu Security Notices (USN) · Jun 29, 2026
• DSA-4461-1 zookeeper - security update Debian Security (DSA / DLA) · Mar 9, 2026
• DLA-1801-1 zookeeper - security update Debian Security (DSA / DLA) · Mar 9, 2026
• SUSE-SU-2020:1190-1 Security update for ardana-ansible, ardana-barbican, ardana-cluster, ardana-db, ardana-designate, ardana-input-model, ardana-logging, ardana-monasca, ardana-mq, ardana-neutron, ardana-octavia, ardana-osconfig, ardana-tempest, ardana-tls, crowbar-core, crowbar-ha, crowbar-openstack, memcached, openstack-ceilometer, openstack-cinder, openstack-designate, openstack-heat, openstack-ironic, openstack-ironic-image, openstack-manila, openstack-neutron, openstack-nova, openstack-octavia, openstack-octav SUSE / openSUSE Security Updates · Feb 4, 2026
• SUSE-RU-2020:2072-1 Security update for ansible, crowbar-core, crowbar-ha, crowbar-openstack, etcd, flannel, grafana, keepalived, kibana, memcached, monasca-installer, openstack-dashboard-theme-SUSE, openstack-manila, openstack-neutron-fwaas, openstack-nova, openstack-tempest, python-Django, python-Pillow, python-psql2mysql, python-psutil, python-py, python-pysaml2, python-waitress, rabbitmq-server, release-notes-suse-openstack-cloud, zookeeper SUSE / openSUSE Security Updates · Feb 4, 2026
• SUSE-SU-2020:1066-1 Security update for ardana-ansible, ardana-barbican, ardana-db, ardana-monasca, ardana-mq, ardana-neutron, ardana-octavia, ardana-tempest, crowbar-core, crowbar-ha, crowbar-openstack, documentation-suse-openstack-cloud, memcached, openstack-manila, openstack-neutron, openstack-nova, pdns, python-amqp, rubygem-puma, zookeeper SUSE / openSUSE Security Updates · Feb 4, 2026
• WID-SEC-2022-0770 IBM DB2: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 8, 2026

References

• 108427 vdb-entry
• [debian-lts-announce] 20190524 [SECURITY] [DLA 1801-1] zookeeper security update mailing-list
• [bookkeeper-issues] 20190531 [GitHub] [bookkeeper] eolivelli opened a new issue #2106: Update ZookKeeper dependency to 3.5.5 mailing-list
• [accumulo-commits] 20190605 [accumulo] branch 2.0 updated: Update ZooKeeper (CVE-2019-0201) mailing-list
• DSA-4461 vendor-advisory
• 20190612 [SECURITY] [DSA 4461-1] zookeeper security update mailing-list
• [activemq-issues] 20190820 [jira] [Created] (AMQ-7279) Security Vulnerabilities in Libraries - jackson-databind-2.9.8.jar, tomcat-servlet-api-8.0.53.jar, tomcat-websocket-api-8.0.53.jar, zookeeper-3.4.6.jar, guava-18.0.jar, jetty-all-9.2.26.v20180806 mailing-list
• RHSA-2019:3140 vendor-advisory
• [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities mailing-list
• [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
• [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
• RHSA-2019:3892 vendor-advisory
• RHSA-2019:4352 vendor-advisory
• https://www.oracle.com/security-alerts/cpujul2020.html
• https://issues.apache.org/jira/browse/ZOOKEEPER-1392
• https://zookeeper.apache.org/security.html#CVE-2019-0201
• https://security.netapp.com/advisory/ntap-20190619-0001/
• https://www.oracle.com/security-alerts/cpuoct2020.html
• https://www.oracle.com//security-alerts/cpujul2021.html
• [hadoop-common-issues] 20210816 [GitHub] [hadoop] iwasakims opened a new pull request #3308: HADOOP-17850. Upgrade ZooKeeper to 3.4.14 in branch-3.2. mailing-list