As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-84439: Apache ZooKeeper: Audit log injection via unsanitized output from multiple sources
CVE-2026-84439 affects Apache ZooKeeper versions 3.8.0 through 3.8.6 and 3.9.0 through 3.9.5 when audit logging is enabled. An unauthenticated attacker can inject arbitrary fields into the audit log by crafting a digest authentication request with embedded tab characters. Organizations relying on audit logs for security monitoring and compliance may have their logs corrupted or misleading records injected.
Why it matters: ZooKeeper operators with audit logging enabled face log poisoning that undermines forensic investigation and compliance verification; immediate patching is recommended for affected versions.
- Source published
- First seen by Cybersecurity Tracker