{"id":"CVE-2026-84501","aliases":["BIT-zookeeper-2026-84501","DEBIAN-CVE-2026-84501","EUVD-2026-80334","GHSA-crhr-qqj8-rpxc","GHSA-mm24-r27q-hxg5","GHSA-r978-9m6m-6gm6","RHLW-2026-19f4511248f79d69","UBUNTU-CVE-2026-84501"],"status":"published","title":"Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProvider","description":"An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth(\"ensemble\", ...) request containing newline characters (\\n). When the ensemble name doesn't match, EnsembleAuthenticationProvider.handleAuthentication() logs the raw, unsanitized name via LOG.warn(). Because SLF4J's {} placeholder preserves embedded newlines, the attacker can forge complete log entries — with arbitrary timestamps, log levels, class names, and messages — that are visually indistinguishable from genuine ZooKeeper log output.\n\nThis issue affects Apache ZooKeeper: from 3.9.0 through 3.9.5, from 3.8.0 through 3.8.6.\n\nUsers are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00742,"percentile":0.55179,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-117"],"published":"2026-09-16T09:28:10Z","modified":"2026-11-10T08:43:12Z","fixes":[{"ecosystem":"Bitnami","package":"zookeeper","fixed_in":["3.8.7","3.9.6"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"zookeeper","fixed_in":["3.9.6-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"zookeeper","ranges":[{"type":"SEMVER","events":[{"introduced":"3.8.0"},{"fixed":"3.8.7"},{"introduced":"3.9.0"},{"fixed":"3.9.6"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.8.0-11","3.8.0-11+deb12u1","3.8.0-11+deb12u2","3.9.1-1","3.9.2-1","3.9.2-2","3.9.3-1","3.9.3-2","3.9.4-1","3.9.4-2","3.9.5-1","3.9.5-2","3.9.6-1"]},{"source":"osv","ecosystem":"Debian:13","package":"zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.9.3-1","3.9.3-1+deb13u1","3.9.3-2","3.9.4-1","3.9.4-2","3.9.5-1","3.9.5-2","3.9.6-1"]},{"source":"osv","ecosystem":"Debian:14","package":"zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.6-1"}]}],"versions":["3.9.3-1","3.9.3-2","3.9.4-1","3.9.4-2","3.9.5-1","3.9.5-2"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.apache.zookeeper:zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.3.rhlw-00015"}]}],"versions":["3.3.0","3.3.1","3.3.2","3.3.3","3.3.4","3.3.5","3.3.6","3.4.0","3.4.1","3.4.10","3.4.11","3.4.12","3.4.13","3.4.14","3.4.2","3.4.3","3.4.4","3.4.5","3.4.6","3.4.7","3.4.8","3.4.9","3.5.0-alpha","3.5.1-alpha","3.5.10","3.5.2-alpha","3.5.3-beta","3.5.4-beta","3.5.5","3.5.6","3.5.7","3.5.8","3.5.9","3.6.0","3.6.1","3.6.2","3.6.3","3.6.4","3.7.0","3.7.1","3.7.2","3.8.0","3.8.1","3.8.2","3.8.3"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.5+dfsg-1","3.4.5+dfsg-1ubuntu0.1~esm1","3.4.5+dfsg-1ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.6-8","3.4.7-1","3.4.8-1","3.4.8-1ubuntu0.1~esm1","3.4.8-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.10-2","3.4.10-3","3.4.13-3","3.4.13-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.13-1","3.4.13-3","3.4.13-3build1","3.4.13-4","3.4.13-5","3.4.13-5build1","3.4.13-5ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.13-5ubuntu4","3.4.13-6ubuntu2","3.4.13-6ubuntu3","3.4.13-6ubuntu4","3.4.13-6ubuntu4.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.8.0-11","3.9.1-1","3.9.1-1build1","3.9.1-1build2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.9.5-1","3.9.5-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.9.3-1build2","3.9.3-1build3","3.9.4-1","3.9.5-1"]}],"products":[{"vendor":"apache","product":"zookeeper"},{"vendor":"apache software foundation","product":"apache zookeeper"}],"references":[{"url":"https://lists.apache.org/thread/ohby1g6zjt72p0w79rhbr41nczzvr33y","tags":["vendor-advisory","Mailing List","Vendor Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/15/7","tags":["Mailing List","discussion","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84501","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-mm24-r27q-hxg5"},{"url":"https://repo.maven.apache.org/maven2","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84501.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-84501","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23944.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/96s5nqssj03rznz9hv58txdb2k1lr79k","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23944","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-r978-9m6m-6gm6","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24308.json","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:10184","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:14272","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:14276","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34608","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8509","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-24308","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24308.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/qng3rtzv2pqkmko4rhv85jfplkyrgqdr","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24308","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-crhr-qqj8-rpxc","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59739.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/v0lrwsbdxvx6w67p3z7fxf3hzyncq55l","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59739","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59969.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/qf9kwsgtgbgtvwls6f41281846xg0rss","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59969","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/79xxx/CVE-2026-79993.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/9cw3rmrzhqpct26v8j18fy41bghlq8y5","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79993","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84439.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/b7qnjvqjh393l0j07tmnb5ggg40sx3m6","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84439","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-84501","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84501","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-84501","title":"Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProvider","description":"An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth(\"ensemble\", ...) request containing newline characters (\\n). When the ensemble name doesn't match, EnsembleAuthenticationProvider.handleAuthentication() logs the raw, unsanitized name via LOG.warn(). Because SLF4J's {} placeholder preserves embedded newlines, the attacker can forge complete log entries — with arbitrary timestamps, log levels, class names, and messages — that are visually indistinguishable from genuine ZooKeeper log output.\n\nThis issue affects Apache ZooKeeper: from 3.9.0 through 3.9.5, from 3.8.0 through 3.8.6.\n\nUsers are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.","status":"published","published":"2026-09-16T09:28:10.294Z","modified":"2026-09-16T19:43:09.161Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-117"],"updated_at":"2026-11-02T14:20:08.734143Z"}],"euvd":[{"id":"EUVD-2026-80334","description":"An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth(\"ensemble\", ...) request containing newline characters (\\n). When the ensemble name doesn't match, EnsembleAuthenticationProvider.handleAuthentication() logs the raw, unsanitized name via LOG.warn(). Because SLF4J's {} placeholder preserves embedded newlines, the attacker can forge complete log entries — with arbitrary timestamps, log levels, class names, and messages — that are visually indistinguishable from genuine ZooKeeper log output.\n\nThis issue affects Apache ZooKeeper: from 3.9.0 through 3.9.5, from 3.8.0 through 3.8.6.\n\nUsers are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.","status":"published","published":"2026-09-16T09:28:10Z","modified":"2026-09-16T19:43:09Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T17:28:14.33177Z"}],"ghsa":[{"id":"GHSA-mm24-r27q-hxg5","title":"An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's...","description":"An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth(\"ensemble\", ...) request containing newline characters (\\n). When the ensemble name doesn't match, EnsembleAuthenticationProvider.handleAuthentication() logs the raw, unsanitized name via LOG.warn(). Because SLF4J's {} placeholder preserves embedded newlines, the attacker can forge complete log entries — with arbitrary timestamps, log levels, class names, and messages — that are visually indistinguishable from genuine ZooKeeper log output.\n\nThis issue affects Apache ZooKeeper: from 3.9.0 through 3.9.5, from 3.8.0 through 3.8.6.\n\nUsers are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.","status":"published","published":"2026-09-16T12:30:31Z","modified":"2026-09-16T21:32:37Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-117"],"updated_at":"2026-11-02T15:12:02.095044Z"}],"nvd":[{"id":"CVE-2026-84501","description":"An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth(\"ensemble\", ...) request containing newline characters (\\n). When the ensemble name doesn't match, EnsembleAuthenticationProvider.handleAuthentication() logs the raw, unsanitized name via LOG.warn(). Because SLF4J's {} placeholder preserves embedded newlines, the attacker can forge complete log entries — with arbitrary timestamps, log levels, class names, and messages — that are visually indistinguishable from genuine ZooKeeper log output.\n\nThis issue affects Apache ZooKeeper: from 3.9.0 through 3.9.5, from 3.8.0 through 3.8.6.\n\nUsers are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.","status":"published","published":"2026-09-16T10:16:53.557Z","modified":"2026-09-18T14:36:51.747Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-117"],"updated_at":"2026-11-02T14:12:48.287983Z"}],"osv":[{"id":"CVE-2026-84501","title":"Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProvider","description":"An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth(\"ensemble\", ...) request containing newline characters (\\n). When the ensemble name doesn't match, EnsembleAuthenticationProvider.handleAuthentication() logs the raw, unsanitized name via LOG.warn(). Because SLF4J's {} placeholder preserves embedded newlines, the attacker can forge complete log entries — with arbitrary timestamps, log levels, class names, and messages — that are visually indistinguishable from genuine ZooKeeper log output.\n\nThis issue affects Apache ZooKeeper: from 3.9.0 through 3.9.5, from 3.8.0 through 3.8.6.\n\nUsers are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.","status":"published","published":"2026-09-16T09:28:10.294Z","modified":"2026-10-28T02:31:09.714886708Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-117"],"updated_at":"2026-11-02T15:45:18.482949Z"},{"id":"DEBIAN-CVE-2026-84501","description":"An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth(\"ensemble\", ...) request containing newline characters (\\n). When the ensemble name doesn't match, EnsembleAuthenticationProvider.handleAuthentication() logs the raw, unsanitized name via LOG.warn(). Because SLF4J's {} placeholder preserves embedded newlines, the attacker can forge complete log entries — with arbitrary timestamps, log levels, class names, and messages — that are visually indistinguishable from genuine ZooKeeper log output.  This issue affects Apache ZooKeeper: from 3.9.0 through 3.9.5, from 3.8.0 through 3.8.6.  Users are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.","status":"published","published":"2026-09-16T10:16:53.557Z","modified":"2026-10-01T03:03:51.287508589Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:46:05.022702Z"},{"id":"RHLW-2026-19f4511248f79d69","title":"Lightwell Security Advisory: zookeeper 3.8.3.rhlw-00015","description":"Red Hat Lightwell has released org.apache.zookeeper:zookeeper 3.8.3.rhlw-00015 with backported fixes for CVE-2024-23944, CVE-2026-24308, CVE-2026-59739, CVE-2026-59969, CVE-2026-79993, CVE-2026-84439, and CVE-2026-84501.\n\nCVE-2024-23944: Apache ZooKeeper: Information disclosure in persistent watcher handling\n\nCVE-2026-24308: Apache ZooKeeper: Sensitive information disclosure in client configuration handling\n\nCVE-2026-59739: Apache ZooKeeper: Information disclosure via SetWatches reconnect replay\n\nCVE-2026-59969: Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode\n\nCVE-2026-79993: Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znode\n\nCVE-2026-84439: Apache ZooKeeper: Audit log injection via unsanitized output from multiple sources\n\nCVE-2026-84501: Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProvider\n\nThis patched artifact is a drop-in replacement for org.apache.zookeeper:zookeeper 3.8.3 from Maven Central.","status":"published","published":"2026-11-09T00:50:22Z","modified":"2026-11-10T08:43:12.631396777Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-10T08:55:24.395105Z"},{"id":"UBUNTU-CVE-2026-84501","description":"An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth(\"ensemble\", ...) request containing newline characters (\\n). When the ensemble name doesn't match, EnsembleAuthenticationProvider.handleAuthentication() logs the raw, unsanitized name via LOG.warn(). Because SLF4J's {} placeholder preserves embedded newlines, the attacker can forge complete log entries — with arbitrary timestamps, log levels, class names, and messages — that are visually indistinguishable from genuine ZooKeeper log output. This issue affects Apache ZooKeeper: from 3.9.0 through 3.9.5, from 3.8.0 through 3.8.6. Users are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.","status":"published","published":"2026-09-16T10:16:00Z","modified":"2026-10-17T13:01:12.735852193Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:57:24.828975Z"},{"id":"BIT-zookeeper-2026-84501","title":"Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProvider","description":"An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth(\"ensemble\", ...) request containing newline characters (\\n). When the ensemble name doesn't match, EnsembleAuthenticationProvider.handleAuthentication() logs the raw, unsanitized name via LOG.warn(). Because SLF4J's {} placeholder preserves embedded newlines, the attacker can forge complete log entries — with arbitrary timestamps, log levels, class names, and messages — that are visually indistinguishable from genuine ZooKeeper log output.\n\nThis issue affects Apache ZooKeeper: from 3.9.0 through 3.9.5, from 3.8.0 through 3.8.6.\n\nUsers are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.","status":"published","published":"2026-09-19T08:51:30.697Z","modified":"2026-09-19T09:15:03.074339196Z","updated_at":"2026-11-02T15:28:36.455807Z"}]}}