CVE-2026-84439: Apache ZooKeeper: Audit log injection via unsanitized output from multiple sources

Remediation

Recommended actions to resolve this vulnerability, in priority order.

1. Upgrade

   Upgrade Apache ZooKeeper to a version that resolves this vulnerability.

   Fixed in 3.9.6
2. Upgrade

   Upgrade Apache ZooKeeper to a version that resolves this vulnerability.

   Fixed in 3.8.7
3. Configuration

   Disable audit logging by setting zookeeper.audit.enable=false to prevent forged fields from being written to zookeeper_audit.log.

   Apache ZooKeeper zookeeper.audit.enable = false

Event History