Zookeeper

This hub aggregates every CVE we track for Zookeeper, a product in the databases space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 11 most recently published vulnerabilities affecting Zookeeper.

• CVE-2026-24308Apache ZooKeeper: Sensitive information disclosure in client configuration handling7.5Mar 7, 2026
• CVE-2026-24281Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager7.4Mar 7, 2026
• CVE-2025-58457Apache ZooKeeper: Insufficient Permission Check in AdminServer Snapshot/Restore Commands4.3Sep 24, 2025
• CVE-2024-51504Apache ZooKeeper: Authentication bypass with IP-based authentication in Admin Server9.1Nov 7, 2024
• CVE-2024-23944Apache ZooKeeper: Information disclosure in persistent watcher handling5.3Mar 15, 2024
• CVE-2023-44981Apache ZooKeeper: Authorization bypass in SASL Quorum Peer Authentication9.1Oct 11, 2023
• CVE-2021-21295Possible request smuggling in HTTP/2 due missing validation5.9Mar 9, 2021
• CVE-2019-0201An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when retrieves the ACLs of the requested node an...5.9May 23, 2019
• CVE-2018-8012No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary end point could j...7.5May 21, 2018
• CVE-2017-5637Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads to the server unable to serve legitimate clien...7.5Oct 10, 2017
• CVE-2016-5017Buffer overflow in the C cli shell in Apache Zookeeper before 3.4.9 and 3.5.x before 3.5.3, when using the "cmd:" batch mode syntax, allows attackers to have unspecified impact via a long command s...8.1Sep 21, 2016