https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-84501.htmlhttps://patchthecve.com/cve/CVE-2026-84501.htmlFri, 18 Sep 2026 14:36:51 +0000MEDIUM 5.3: An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble", ...) request containing newline characters (\n). When the ensemble name doesn't match, EnsembleAuthenticationProvider.handleAuthentication() logs the raw,https://patchthecve.com/cve/CVE-2026-84439.htmlhttps://patchthecve.com/cve/CVE-2026-84439.htmlFri, 18 Sep 2026 14:37:30 +0000MEDIUM 5.3: When audit logging is enabled (zookeeper.audit.enable=true), an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sending a digest authentication request with tab characters (\t) embedded in the username. Because the audit log uses tab-separated key=value formhttps://patchthecve.com/cve/CVE-2026-79993.htmlhttps://patchthecve.com/cve/CVE-2026-79993.htmlFri, 18 Sep 2026 14:37:21 +0000HIGH 7.5: The `deleteContainer` opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent. This opcode is considered internal-only and the official clihttps://patchthecve.com/cve/CVE-2026-59969.htmlhttps://patchthecve.com/cve/CVE-2026-59969.htmlFri, 18 Sep 2026 14:31:23 +0000HIGH 7.5: Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted peer https://patchthecve.com/cve/CVE-2026-59739.htmlhttps://patchthecve.com/cve/CVE-2026-59739.htmlFri, 18 Sep 2026 14:37:10 +0000HIGH 7.5: Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restricted ACLs. Issue is caused by incomplete fi