Description
Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache ZooKeeper | 3.9.0 – ≤ 3.9.4, 3.8.0 – ≤ 3.8.5 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | zookeeper | 3.9.5-1 | — |
| Debian 13 | zookeeper | No fix yet | — |
| Debian 12 | zookeeper | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | zookeeper | No fix yet | — |
| Ubuntu 26.04 LTS | zookeeper | No fix yet | — |
| Ubuntu 25.10 | zookeeper | No fix yet | — |
| Ubuntu 24.04 LTS | zookeeper | No fix yet | — |
| Ubuntu 22.04 LTS | zookeeper | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | zookeeper | No fix yet | — |
| Ubuntu Pro 18.04 LTS | zookeeper | No fix yet | — |
| Ubuntu Pro 16.04 LTS | zookeeper | No fix yet | — |
| Ubuntu Pro 14.04 LTS | zookeeper | No fix yet | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | akhq | 0.26.0-r11 | — |
| Wolfi rolling | apache-activemq-artemis | 2.53.0-r2 | — |
| Wolfi rolling | apache-nifi | 2.8.0-r4 | — |
| Wolfi rolling | apache-pulsar-4.1 | 4.1.3-r7 | — |
| Wolfi rolling | confluent-common-docker | No fix yet | — |
| Wolfi rolling | druid | 36.0.0-r5 | — |
| Wolfi rolling | kserve-modelmesh | 0.12.0-r26 | — |
| Wolfi rolling | spark-4.0-scala-2.13 | 4.0.2-r7 | — |
| Wolfi rolling | spark-4.1-scala-2.13 | 4.1.1-r7 | — |
| Wolfi rolling | strimzi-kafka-operator-kafka-thirdparty-libs-cc | 0.51.0-r1 | — |
| Wolfi rolling | tez | 0.10.5-r8 | — |
| Wolfi rolling | thingsboard-tb-node +1 | 4.3.1-r1 | — |
| Wolfi rolling | trino-plugin-kafka +3 | 480-r0 | — |
| Wolfi rolling | zookeeper-3.9 | 3.9.5-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.zookeeper:zookeeper | >= 3.9.0, < 3.9.5 | 3.9.5 | GHSA-crhr-qqj8-rpxc |
| Maven | org.apache.zookeeper:zookeeper | >= 3.8.0, < 3.8.6 | 3.8.6 | GHSA-crhr-qqj8-rpxc |
Advisories 8
- WID-SEC-2026-2451 Oracle Siebel CRM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 2, 2026
- NCSC-2026-0258 Kwetsbaarheden verholpen in Oracle Financial Services NCSC-NL (Netherlands) · Jul 22, 2026
- WID-SEC-2026-2448 Oracle Utilities Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 21, 2026
- WID-SEC-2026-2445 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 21, 2026
- WID-SEC-2026-2436 Oracle Construction and Engineering: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 21, 2026
- WID-SEC-2026-2434 Oracle TimesTen In-Memory Database: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 21, 2026
- WID-SEC-2026-1032 IBM Tivoli Network Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 7, 2026
- WID-SEC-2026-1723 Oracle Communications Unified Assurance: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 28, 2026
References
- https://lists.apache.org/thread/qng3rtzv2pqkmko4rhv85jfplkyrgqdr vendor-advisory