Skip to content
VulniPulse
Sign in
Highest advisory severityMedium 2 vendors · 2 advisories

CVE-2026-84501

CVE-2026-84501: 2 tracked advisory records across Apache, Red Hat. Compare vendor sources and published fix guidance.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

Vendor advisory comparison

Apache

1 advisory
  • Advisory severityMedium5.3

    Medium [CVE-2026-84501] unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble",...) request containing newline characters (\n)

    CVE-2026-84501Source published Source updated

    An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble",...) request containing newline characters (\n). When the ensemble name doesn't match, EnsembleAuthenticationProvider.handleAuthentication() logs the raw, unsanitized name via LOG.warn(). Because SLF4J's {} placeholder preserves embedded newlines, the attacker can forge complete log entries — with arbitrary timestamps, log levels, class names, and messages — that are visually indistinguishable from genuine ZooKeeper log output. This issue affects Apache ZooKeeper: from 3.9.0 through 3.9.5, from 3.8.0 through 3.8.6. Users are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.

    Affected products in this advisory
    • Apache ZooKeeper
    Source-reported affected versions
    • 3.9.0 through 3.9.5
    • 3.8.0 through 3.8.6.
    • through 3.8.6
    Source-reported fixed versions
    • 3.8.7
    • 3.9.6
    Mitigation guidance
    • Users are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.
    Full advisory and evidenceOpen source bulletin

Red Hat

1 advisory
  • Advisory severityMedium5.3

    Medium [CVE-2026-84501] Operational log forgery via newline injection

    CVE-2026-84501Source published Source updated

    Operational log forgery via newline injection. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-117. Affected products named by the advisory: Red Hat AMQ Broker 7; Red Hat build of Apache Camel for Spring Boot 4; Red Hat Fuse 7; Red Hat JBoss Enterprise Application Platform 8; and 3 more.

    Related products — impact not confirmed
    • Red Hat AMQ Broker 7
    • Red Hat build of Apache Camel for Spring Boot 4
    • Red Hat Fuse 7
    • Red Hat JBoss Enterprise Application Platform 8

    3 more entries in the full advisory.

    Source-reported affected versions
    • 3.9.0
    • 3.9.5
    • 3.8.0
    • 3.8.6
    Source-reported fixed versions
    • 3.8.7
    • 3.9.6
    Mitigation guidance
    • Update to Apache ZooKeeper 3.8.7, 3.9.6, or later.
    Full advisory and evidenceOpen source bulletin

Android app · Google Play

Turn CVE research into alerts on your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features