RHLW-2026-19f4511248f79d69: Lightwell Security Advisory: zookeeper 3.8.3.rhlw-00015
Red Hat Lightwell has released org.apache.zookeeper:zookeeper 3.8.3.rhlw-00015 with backported fixes for CVE-2024-23944, CVE-2026-24308, CVE-2026-59739, CVE-2026-59969, CVE-2026-79993, CVE-2026-84439, and CVE-2026-84501.
CVE-2024-23944: Apache ZooKeeper: Information disclosure in persistent watcher handling
CVE-2026-24308: Apache ZooKeeper: Sensitive information disclosure in client configuration handling
CVE-2026-59739: Apache ZooKeeper: Information disclosure via SetWatches reconnect replay
CVE-2026-59969: Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode
CVE-2026-79993: Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znode
CVE-2026-84439: Apache ZooKeeper: Audit log injection via unsanitized output from multiple sources
CVE-2026-84501: Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProvider
This patched artifact is a drop-in replacement for org.apache.zookeeper:zookeeper 3.8.3 from Maven Central.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
red-hat-lightwell/org.apache.zookeeper:zookeeperto a version that resolves this vulnerability.Fixed in 3.8.3.rhlw-00015 - Upgrade
Upgrade
org.apache.zookeeper:zookeeperto a version that resolves this vulnerability.Fixed in 3.8.3.rhlw-00015
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
What access does an attacker need to exploit the affected issues?
The advisory’s CVSS vector indicates local access and low privileges are required. No user interaction is required.
What is the overall impact indicated by the severity rating?
The advisory rates the issue set as medium severity with a CVSS score of 5.3. The vector indicates low potential impact to confidentiality, integrity, and availability.
Can the updated artifact be used without changing the existing ZooKeeper dependency version line?
Yes. The advisory states that org.apache.zookeeper:zookeeper 3.8.3.rhlw-00015 is a drop-in replacement for org.apache.zookeeper:zookeeper 3.8.3 from Maven Central.