EN PT-BR
← Voltar ao feed
medium

CERT-FR Advisory: Multiple Apache ZooKeeper Vulnerabilities Enable DoS and Security Bypass

1 fonte(s) · 1 atualização(ões) · publicado 03/11/2026 21:00 · coletado há 1 hora

CERT-FR published advisory CERTFR-2026-AVI-1448 on 04 November 2026 covering multiple vulnerabilities in Apache ZooKeeper versions 3.8.x prior to 3.8.8 and 3.9.x prior to 3.9.7. The flaws allow a remote attacker to cause a denial of service and bypass security policy. CERT-FR references the official Apache ZooKeeper security bulletin dated the same day and directs administrators to apply the corresponding patches.

Entenda a falha

A vulnerabilidade

CERT-FR advisory CERTFR-2026-AVI-1448 covers five CVEs in Apache ZooKeeper: CVE-2026-100235, CVE-2026-100252, CVE-2026-100300, CVE-2026-100302 and CVE-2026-115448. The sources do not give a per-CVE breakdown or severity, only that together they let a remote attacker cause a denial of service and bypass the security policy. Affected versions are 3.8.x before 3.8.8 and 3.9.x before 3.9.7; the fixes are in 3.8.8 and 3.9.7 according to the advisory's version ranges. The articles do not state required authentication, configuration or user interaction.

Como foi descoberta

The articles do not say who found the flaws or how. CERT-FR published its advisory on 04 November 2026, pointing to the official Apache ZooKeeper security bulletin of the same date as the source of patches.

Explicação gerada por IA a partir da matéria e dos artigos, em 05/11/2026 16:19.

Detalhes técnicos

  • Affected versions: ZooKeeper 3.8.x < 3.8.8 and 3.9.x < 3.9.7.
  • Five CVEs are referenced: CVE-2026-100235, CVE-2026-100252, CVE-2026-100300, CVE-2026-100302, CVE-2026-115448.
  • Impact includes remote denial of service and security policy bypass.

Remediação

  • Apply the fixes referenced in the official Apache ZooKeeper security bulletin dated 04 November 2026.

Linha do tempo

  1. cert.cyber.gouv.fr ↗ · pub. 03/11/2026 21:00 · coletado 05/11 16:00 primeiro registro

    CERT-FR Advisory: Multiple Apache ZooKeeper Vulnerabilities Enable DoS and Security Bypass

    ler a análise desta fonte

    CERT-FR published advisory CERTFR-2026-AVI-1448 on 04 November 2026 covering multiple vulnerabilities in Apache ZooKeeper versions 3.8.x prior to 3.8.8 and 3.9.x prior to 3.9.7. The flaws allow a remote attacker to cause a denial of service and bypass security policy. CERT-FR references the official Apache ZooKeeper security bulletin dated the same day and directs administrators to apply the corresponding patches.

    Technical Details

    • Affected versions: ZooKeeper 3.8.x < 3.8.8 and 3.9.x < 3.9.7.
    • Five CVEs are referenced: CVE-2026-100235, CVE-2026-100252, CVE-2026-100300, CVE-2026-100302, CVE-2026-115448.
    • Impact includes remote denial of service and security policy bypass.

    Remediation

    • Apply the fixes referenced in the official Apache ZooKeeper security bulletin dated 04 November 2026.