CVE-2024-23944
Apache ZooKeeper: Information disclosure in persistent watcher handling
CVE-2024-23944 is a medium vulnerability (CVSS 5.3) in Apache Zookeeper, published March 15, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.25%, the 16th percentile. Fixed in org.apache.zookeeper:zookeeper 3.8.4.
- Severity
- 5.3 MediumCVSS 3.1, CVE List
- Exploit chance
- 0.25%EPSS, 16th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
3.8.4org.apache.zookeeper:zookeeper +11 more
Description
Information disclosure in persistent watchers handling in Apache ZooKeeper due to missing ACL check. It allows an attacker to monitor child znodes by attaching a persistent watcher (addWatch command) to a parent which the attacker has already access to. ZooKeeper server doesn't do ACL check when the persistent watcher is triggered and as a consequence, the full path of znodes that a watch event gets triggered upon is exposed to the owner of the watcher. It's important to note that only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive information like user name or login ID, this issue is potentially critical.
Users are recommended to upgrade to version 3.9.2, 3.8.4 which fixes the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.zookeeper:zookeeperMaven | 3.8.0 to 3.8.3 | 3.8.4 |
org.apache.zookeeper:zookeeperMaven | 3.9.0 to 3.9.1 | 3.9.2 |
org.apache.zookeeper:zookeeperMaven | 3.6.0 to 3.7.2 | None known |
zookeeperBitnami | 3.6.0 up to 3.8.4, 3.9.0 up to 3.9.2 | 3.8.43.9.2 |
zookeeperDebian:12 | before 3.8.0-11+deb12u2, plus listed versions 3.8.0-113.8.0-11+deb12u1 | 3.8.0-11+deb12u2 |
zookeeperDebian:13 | before 3.9.2-1 | 3.9.2-1 |
zookeeperDebian:14 | before 3.9.2-1 | 3.9.2-1 |
org.apache.zookeeper:zookeeperMaven | 3.8.0 up to 3.8.4, plus listed versions 3.8.13.8.23.8.3 | 3.8.4 |
org.apache.zookeeper:zookeeperMaven | 3.9.0 up to 3.9.2, plus listed versions 3.9.1 | 3.9.2 |
org.apache.zookeeper:zookeeperMaven | 3.6.0 to 3.7.2, plus listed versions 3.6.13.6.23.6.33.6.43.7.03.7.1 | None known |
org.apache.zookeeper:zookeeperRed Hat Lightwell:Maven From an advisory covering 7 CVEs | before 3.8.3.rhlw-00015, plus listed versions 3.3.03.3.13.3.23.3.33.3.4 Show 40 moreShow less3.3.53.3.63.4.03.4.13.4.103.4.113.4.123.4.133.4.143.4.23.4.33.4.43.4.53.4.63.4.73.4.83.4.93.5.0-alpha3.5.1-alpha3.5.103.5.2-alpha3.5.3-beta3.5.4-beta3.5.53.5.63.5.73.5.83.5.93.6.03.6.13.6.23.6.33.6.43.7.03.7.13.7.23.8.03.8.13.8.23.8.3 | 3.8.3.rhlw-00015 |
zookeeperUbuntu:24.04:LTS | All versions, plus listed versions 3.8.0-113.9.1-13.9.1-1build13.9.1-1build2 | None known |
What each source reports
CVE List Score used
Apache ZooKeeper: Information disclosure in persistent watcher handling
Information disclosure in persistent watchers handling in Apache ZooKeeper due to missing ACL check. It allows an attacker to monitor child znodes by attaching a persistent watcher (addWatch command) to a parent which the attacker has already access to. ZooKeeper server doesn't do ACL check when the persistent watcher is triggered and as a consequence, the full path of znodes that a watch event gets triggered upon is exposed to the owner of the watcher. It's important to note that only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive information like user name or login ID, this issue is potentially critical.
Users are recommended to upgrade to version 3.9.2, 3.8.4 which fixes the issue.
- Record
CVE-2024-23944- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-862
- Updated
- 2026-11-02
EUVDEUVD-2024-1001
Information disclosure in persistent watchers handling in Apache ZooKeeper due to missing ACL check. It allows an attacker to monitor child znodes by attaching a persistent watcher (addWatch command) to a parent which the attacker has already access to. ZooKeeper server doesn't do ACL check when the persistent watcher is triggered and as a consequence, the full path of znodes that a watch event gets triggered upon is exposed to the owner of the watcher. It's important to note that only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive information like user name or login ID, this issue is potentially critical.
Users are recommended to upgrade to version 3.9.2, 3.8.4 which fixes the issue.
- Record
EUVD-2024-1001- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-r978-9m6m-6gm6
Apache ZooKeeper vulnerable to information disclosure in persistent watchers handling
Information disclosure in persistent watchers handling in Apache ZooKeeper due to missing ACL check. It allows an attacker to monitor child znodes by attaching a persistent watcher (addWatch command) to a parent which the attacker has already access to. ZooKeeper server doesn't do ACL check when the persistent watcher is triggered and as a consequence, the full path of znodes that a watch event gets triggered upon is exposed to the owner of the watcher. It's important to note that only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive information like user name or login ID, this issue is potentially critical.
Users are recommended to upgrade to version 3.9.2, 3.8.4 which fixes the issue.
- Record
GHSA-r978-9m6m-6gm6- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-200, CWE-862
- Updated
- 2026-11-02
NVD
Information disclosure in persistent watchers handling in Apache ZooKeeper due to missing ACL check. It allows an attacker to monitor child znodes by attaching a persistent watcher (addWatch command) to a parent which the attacker has already access to. ZooKeeper server doesn't do ACL check when the persistent watcher is triggered and as a consequence, the full path of znodes that a watch event gets triggered upon is exposed to the owner of the watcher. It's important to note that only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive information like user name or login ID, this issue is potentially critical.
Users are recommended to upgrade to version 3.9.2, 3.8.4 which fixes the issue.
- Record
CVE-2024-23944- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-862
- Updated
- 2026-11-02
OSV
Apache ZooKeeper: Information disclosure in persistent watcher handling
Information disclosure in persistent watchers handling in Apache ZooKeeper due to missing ACL check. It allows an attacker to monitor child znodes by attaching a persistent watcher (addWatch command) to a parent which the attacker has already access to. ZooKeeper server doesn't do ACL check when the persistent watcher is triggered and as a consequence, the full path of znodes that a watch event gets triggered upon is exposed to the owner of the watcher. It's important to note that only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive information like user name or login ID, this issue is potentially critical.
Users are recommended to upgrade to version 3.9.2, 3.8.4 which fixes the issue.
- Record
CVE-2024-23944- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-862
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-23944
Information disclosure in persistent watchers handling in Apache ZooKeeper due to missing ACL check. It allows an attacker to monitor child znodes by attaching a persistent watcher (addWatch command) to a parent which the attacker has already access to. ZooKeeper server doesn't do ACL check when the persistent watcher is triggered and as a consequence, the full path of znodes that a watch event gets triggered upon is exposed to the owner of the watcher. It's important to note that only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive information like user name or login ID, this issue is potentially critical. Users are recommended to upgrade to version 3.9.2, 3.8.4 which fixes the issue.
- Record
DEBIAN-CVE-2024-23944- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
Show 5 moreShow less
OSVGHSA-r978-9m6m-6gm6
Apache ZooKeeper vulnerable to information disclosure in persistent watchers handling
Information disclosure in persistent watchers handling in Apache ZooKeeper due to missing ACL check. It allows an attacker to monitor child znodes by attaching a persistent watcher (addWatch command) to a parent which the attacker has already access to. ZooKeeper server doesn't do ACL check when the persistent watcher is triggered and as a consequence, the full path of znodes that a watch event gets triggered upon is exposed to the owner of the watcher. It's important to note that only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive information like user name or login ID, this issue is potentially critical.
Users are recommended to upgrade to version 3.9.2, 3.8.4 which fixes the issue.
- Record
GHSA-r978-9m6m-6gm6- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-200, CWE-862
- Updated
- 2026-11-02
OSVRHLW-2026-19f4511248f79d69
Lightwell Security Advisory: zookeeper 3.8.3.rhlw-00015
Red Hat Lightwell has released org.apache.zookeeper:zookeeper 3.8.3.rhlw-00015 with backported fixes for CVE-2024-23944, CVE-2026-24308, CVE-2026-59739, CVE-2026-59969, CVE-2026-79993, CVE-2026-84439, and CVE-2026-84501.
CVE-2024-23944: Apache ZooKeeper: Information disclosure in persistent watcher handling
CVE-2026-24308: Apache ZooKeeper: Sensitive information disclosure in client configuration handling
CVE-2026-59739: Apache ZooKeeper: Information disclosure via SetWatches reconnect replay
CVE-2026-59969: Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode
CVE-2026-79993: Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znode
CVE-2026-84439: Apache ZooKeeper: Audit log injection via unsanitized output from multiple sources
CVE-2026-84501: Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProvider
This patched artifact is a drop-in replacement for org.apache.zookeeper:zookeeper 3.8.3 from Maven Central.
- Record
RHLW-2026-19f4511248f79d69- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-10
OSVROOT-APP-MAVEN-CVE-2024-23944
CVE-2024-23944 in io.root.org.apache.zookeeper:zookeeper - Patched by Root
Root has patched CVE-2024-23944 in the io.root.org.apache.zookeeper:zookeeper package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2024-23944- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-23944
Information disclosure in persistent watchers handling in Apache ZooKeeper due to missing ACL check. It allows an attacker to monitor child znodes by attaching a persistent watcher (addWatch command) to a parent which the attacker has already access to. ZooKeeper server doesn't do ACL check when the persistent watcher is triggered and as a consequence, the full path of znodes that a watch event gets triggered upon is exposed to the owner of the watcher. It's important to note that only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive information like user name or login ID, this issue is potentially critical. Users are recommended to upgrade to version 3.9.2, 3.8.4 which fixes the issue.
- Record
UBUNTU-CVE-2024-23944- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVBIT-zookeeper-2024-23944No score
Apache ZooKeeper: Information disclosure in persistent watcher handling
Information disclosure in persistent watchers handling in Apache ZooKeeper due to missing ACL check. It allows an attacker to monitor child znodes by attaching a persistent watcher (addWatch command) to a parent which the attacker has already access to. ZooKeeper server doesn't do ACL check when the persistent watcher is triggered and as a consequence, the full path of znodes that a watch event gets triggered upon is exposed to the owner of the watcher. It's important to note that only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive information like user name or login ID, this issue is potentially critical.
Users are recommended to upgrade to version 3.9.2, 3.8.4 which fixes the issue.
- Record
BIT-zookeeper-2024-23944- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, facts, references | OSV | |
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
lists.apache.org/thread/96s5nqssj03rznz9hv58txdb2k1lr79k
openwall.com/lists/oss-security/2024/03/14/2
nvd.nist.gov/vuln/detail/CVE-2024-23944
github.com/apache/zookeeper/commit/29c7b9462681f47c2ac12e609341cf9f52abac5c
Show 33 moreShow less
repo.maven.apache.org/maven2
security-tracker.debian.org/tracker/CVE-2024-23944
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24308.json
access.redhat.com/errata/RHSA-2026:10184
ubuntu.com/security/CVE-2024-23944
cve.org/CVERecord?id=CVE-2024-23944