Skip to content
VulniPulse
Sign in
Highest advisory severityMedium 1 vendor · 1 advisory

CVE-2026-84439

CVE-2026-84439: 1 tracked advisory record across Apache. Compare vendor sources and published fix guidance.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

Vendor advisory comparison

Apache

1 advisory
  • Advisory severityMedium5.3

    Medium [CVE-2026-84439] When audit logging is enabled (zookeeper.audit.enable=true), an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sending a digest authentication request with tab characters (\t) embedded in the username

    CVE-2026-84439Source published Source updated

    When audit logging is enabled (zookeeper.audit.enable=true), an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sending a digest authentication request with tab characters (\t) embedded in the username. Because the audit log uses tab-separated key=value format, the injected tabs are parsed as legitimate field separators, allowing the attacker to spoof audit results (e.g., injecting result=success), forge operation types, and corrupt forensic evidence. A log injection vulnerability in Apache ZooKeeper allows a client that can call setACL to inject forged key-value fields into zookeeper_audit.log. When audit logging is enabled, the server serializes attacker-controlled digest ACL ids into the acl= audit field without escaping tab characters.…

    Affected products in this advisory
    • Apache ZooKeeper
    Source-reported affected versions
    • 3.9.0 through 3.9.5
    • 3.8.0 through 3.8.6.
    • through 3.8.6
    Source-reported fixed versions
    • 3.9.6
    • 3.8.7
    Mitigation guidance
    • When audit logging is enabled (zookeeper.audit.enable=true), an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sending a digest authentication request with tab characters (\t) embedded in the username.
    • Users are recommended to upgrade to version 3.9.6 or 3.8.7, which fixes the issue.
    Full advisory and evidenceOpen source bulletin

Android app · Google Play

Monitor future Apache CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features