Apache Zookeeper
11 CVEs affecting Apache Zookeeper. Latest disclosed: 2026-03-07. Critical: 2, High: 5.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-51504 | Critical | 9.1 | 2024-11-07 | When using IPAuthenticationProvider in ZooKeeper Admin Server there is a possibility of Authentication Bypass by Spoofing -- this only impacts IP based authent… |
CVE-2023-44981 | Critical | 9.1 | 2023-10-11 | Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper. If SASL Quorum Peer authentication is enabled in ZooKeeper (quorum.auth.ena… |
CVE-2016-5017 | High | 8.1 | 2016-09-21 | Buffer overflow in the C cli shell in Apache Zookeeper before 3.4.9 and 3.5.x before 3.5.3, when using the "cmd:" batch mode syntax, allows attackers to have u… |
CVE-2026-24308 | High | 7.5 | 2026-03-07 | Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information s… |
CVE-2018-8012 | High | 7.5 | 2018-05-21 | No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a… |
CVE-2017-5637 | High | 7.5 | 2017-10-10 | Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads to the s… |
CVE-2026-24281 | High | 7.4 | 2026-03-07 | Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof… |
CVE-2021-21295 | Medium | 5.9 | 2021-03-09 | Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clie… |
CVE-2019-0201 | Medium | 5.9 | 2019-05-23 | An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when retrieves… |
CVE-2024-23944 | Medium | 5.3 | 2024-03-15 | Information disclosure in persistent watchers handling in Apache ZooKeeper due to missing ACL check. It allows an attacker to monitor child znodes by attaching… |
CVE-2025-58457 | Medium | 4.3 | 2025-09-24 | Improper permission check in ZooKeeper AdminServer lets authorized clients to run snapshot and restore command with insufficient permissions. This issue affec… |