Apache Fixes 35 Flaws Across ZooKeeper, OpenOffice, ActiveMQ and Juneau; No Patches for JClouds and Oozie
The Apache Software Foundation disclosed 35 security flaws across nine projects on November 2-3, 2026, affecting Apache ZooKeeper, Apache OpenOffice, Apache ActiveMQ, Apache Juneau, HertzBeat, JClouds and Oozie. Twenty flaws are rated high severity, with the top score reaching 8.7 (CVSSv4). No active exploitation or public proof-of-concept has been confirmed for any of these vulnerabilities. The retired projects JClouds and Oozie will not receive patches and should be replaced or restricted to trusted users.
Entenda a falha
A vulnerabilidade
The Apache Software Foundation disclosed 35 flaws across nine projects on November 2-3, 2026. The most severe are in ZooKeeper. CVE-2026-115448 (CVSS 8.7) is unbounded recursion on deep znode trees. Because the default root ACL is open, any client can create such a tree, which risks data loss across an ensemble. CVE-2026-100300 (8.7) lets unauthenticated clients write to the quota subtree and can leave the data directory permanently unbootable. CVE-2026-100252 (8.6) affects SASL setups: a client can claim any authorization identity and gets superuser access if it matches a configured superuser. CVE-2026-100302 (7.1) is a remote crash from one small request, and CVE-2026-100235 (6.0) is a race condition in ACL changes. ZooKeeper is affected up to 3.8.7 and 3.9.6 and fixed in 3.8.8 and 3.9.7; the multiRead bug affects 3.7.0 and later and is fixed only in 3.9.7. OpenOffice 4.1.16 and earlier has 12 flaws, including CVE-2026-90628 (possible code execution via PDF export), CVE-2026-90627 (local file read) and CVE-2026-90632 (local file access via GStreamer), fixed in 4.1.17. ActiveMQ CVE-2026-108946 lets an authenticated client spoof IDs and read another client's temporary queues; it i…
Como funciona
In ZooKeeper, when the server writes a snapshot it walks the znode tree recursively, using one stack frame per level with no depth limit. Since the default root ACL lets any client create znodes, a very deep tree can be built and the snapshot step goes wrong. For the quota flaw, an unauthenticated write reaches the quota subtree and a request thread crashes, which can leave the data directory unable to boot. In the SASL case, the server accepts whatever authorization identity the client requests, and if it matches a superuser the client is treated as one. In OpenOffice, a crafted PDF, WMF, DXF or Word file is parsed and the parser mishandles memory, or the document is allowed to pull in local files without asking the user.
Por que é vulnerável
The ZooKeeper bugs come from missing limits and checks and from risky defaults: no depth bound in snapshot recursion, an open root ACL by default, unauthenticated writes accepted in the quota subtree, and a SASL path that trusts the identity the client claims. A race condition affects ACL changes. In OpenOffice the root causes are unsafe parsing of document formats that corrupts memory, and file access that does not ask the user. The articles do not describe the exact code changes in each fix, but the ZooKeeper advisory suggests restricting znode creation with ACLs and authentication instead of the default open root ACL.
Como foi descoberta
The articles do not say who found these flaws or how. They only say the Apache Software Foundation disclosed 35 flaws across nine projects on November 2 and 3, 2026, and that OpenOffice 4.1.17 was released on October 14. No exploitation in the wild has been confirmed.
Explicação gerada por IA a partir da matéria e dos artigos, em 04/11/2026 23:16.
Detalhes técnicos
ZooKeeper has five flaws: CVE-2026-115448 (CVSS 8.7) allows unbounded recursion on deep znode trees due to the default open root ACL, risking data loss across an ensemble; CVE-2026-100300 (CVSS 8.7) allows unauthenticated writes to the quota subtree, potentially rendering the data directory permanently unbootable; CVE-2026-100252 (CVSS 8.6) affects SASL setups, letting a client claim any authorization identity and gain superuser access if it matches a configured superuser; CVE-2026-100302 (CVSS 7.1) allows remote crash via a single small request; CVE-2026-100235 (CVSS 6.0) is a race condition in ACL changes.
OpenOffice 4.1.17 fixes 12 flaws (9 high, 2 medium, 1 low) involving crafted PDF, WMF, DXF or Word files causing memory corruption or data leaks, including CVE-2026-90628 (potential code execution via PDF export), CVE-2026-90627 (arbitrary local file read) and CVE-2026-90632 (local file access via GStreamer).
ActiveMQ has 5 broker flaws plus 1 low-severity flaw in the .NET NMS client, mostly affecting authenticated clients, including CVE-2026-108946 allowing ID spoofing and reading from another client's temporary queues.
Juneau has 9 flaws including credential header leaks on cross-host redirects, cleartext logging of Authorization/Cookie headers after errors, and a MessagePack parsing bug enabling memory exhaustion from tiny requests. HertzBeat has an XPath validation CPU-exhaustion bug, JClouds an XML entity expansion flaw, and Oozie a tenant workflow hijack issue.
Remediação
Upgrade ZooKeeper to 3.8.8 or 3.9.7 (multiRead fix only in 3.9.7); as a stopgap, restrict znode creation with ACLs and authentication rather than relying on the default open root ACL. Install OpenOffice 4.1.17. Move ActiveMQ to 6.4.0, 6.3.3 or 5.19.12, and NMS ActiveMQ to 2.3.0. Update HertzBeat to 1.9.1 and check the Juneau security page for fixed releases. Replace JClouds and Oozie or limit them to trusted users.
Linha do tempo
-
Apache Fixes 35 Flaws Across ZooKeeper, OpenOffice, ActiveMQ and Juneau; No Patches for JClouds and Oozie
ler a análise desta fonte ocultar
The Apache Software Foundation disclosed 35 security flaws across nine projects on November 2-3, 2026, affecting Apache ZooKeeper, Apache OpenOffice, Apache ActiveMQ, Apache Juneau, HertzBeat, JClouds and Oozie. Twenty flaws are rated high severity, with the top score reaching 8.7 (CVSSv4). No active exploitation or public proof-of-concept has been confirmed for any of these vulnerabilities. The retired projects JClouds and Oozie will not receive patches and should be replaced or restricted to trusted users.
Technical Details
ZooKeeper has five flaws: CVE-2026-115448 (CVSS 8.7) allows unbounded recursion on deep znode trees due to the default open root ACL, risking data loss across an ensemble; CVE-2026-100300 (CVSS 8.7) allows unauthenticated writes to the quota subtree, potentially rendering the data directory permanently unbootable; CVE-2026-100252 (CVSS 8.6) affects SASL setups, letting a client claim any authorization identity and gain superuser access if it matches a configured superuser; CVE-2026-100302 (CVSS 7.1) allows remote crash via a single small request; CVE-2026-100235 (CVSS 6.0) is a race condition in ACL changes.
OpenOffice 4.1.17 fixes 12 flaws (9 high, 2 medium, 1 low) involving crafted PDF, WMF, DXF or Word files causing memory corruption or data leaks, including CVE-2026-90628 (potential code execution via PDF export), CVE-2026-90627 (arbitrary local file read) and CVE-2026-90632 (local file access via GStreamer).
ActiveMQ has 5 broker flaws plus 1 low-severity flaw in the .NET NMS client, mostly affecting authenticated clients, including CVE-2026-108946 allowing ID spoofing and reading from another client's temporary queues.
Juneau has 9 flaws including credential header leaks on cross-host redirects, cleartext logging of Authorization/Cookie headers after errors, and a MessagePack parsing bug enabling memory exhaustion from tiny requests. HertzBeat has an XPath validation CPU-exhaustion bug, JClouds an XML entity expansion flaw, and Oozie a tenant workflow hijack issue.
Remediation
Upgrade ZooKeeper to 3.8.8 or 3.9.7 (multiRead fix only in 3.9.7); as a stopgap, restrict znode creation with ACLs and authentication rather than relying on the default open root ACL. Install OpenOffice 4.1.17. Move ActiveMQ to 6.4.0, 6.3.3 or 5.19.12, and NMS ActiveMQ to 2.3.0. Update HertzBeat to 1.9.1 and check the Juneau security page for fixed releases. Replace JClouds and Oozie or limit them to trusted users.