Loading story…
Apache ZooKeeper security materials list two newly assigned vulnerability identifiers, CVE-2026-24281 and CVE-2026-24308. The supplied CVE records do not provide vulnerability descriptions, affected versions, severity ratings, exploit conditions, or remediation guidance.
A related Apache ZooKeeper issue, ZOOKEEPER-4986, calls for disabling reverse-DNS lookups in TLS clients and servers. Organizations running ZooKeeper should review the project’s security advisories and release notes, identify deployed versions, and assess TLS/DNS configuration changes before applying relevant updates or mitigations.
See affected versions and whether adversaries are exploiting it.
4 references tracked. Mallory keeps watching after this page renders.
cve.org
Open sourcecve.org
Open sourcezookeeper.apache.org
Open sourceissues.apache.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Apache Software Foundation released security updates for **Apache CXF** to fix three newly disclosed vulnerabilities affecting enterprise deployments of the services framework. The flaws include **`CVE-2026-44930`**, an LDAP injection issue in the XKMS LDAP certificate repository that can let attackers manipulate backend search filters and retrieve arbitrary digital certificates, potentially enabling impersonation, interception of encrypted communications, and lateral movement. Apache also addressed an **XXE** flaw in WS-Transfer caused by insecure XML parser configuration, which could expose sensitive files and support internal network mapping, as well as a possible **remote code execution** condition tied to an incomplete fix for an older JMS-related bug. Affected releases include **4.2.0**, **4.0.0 through 4.1.5**, and older branches before **3.6.11**. Apache published patched versions **4.2.1**, **4.1.6**, and **3.6.11**, and guidance urges organizations to upgrade immediately, review LDAP access controls, monitor certificate access activity, and reduce exposure of XKMS components where possible. The disclosures indicate that while the LDAP flaw does not itself provide code execution, the combined set of weaknesses could materially affect trust infrastructure and server security in vulnerable environments.
Jun 29, 2026
Red Hat released **Important** security updates for **Red Hat AMQ Broker 7.12.7** and **7.13.5**, addressing multiple vulnerabilities in bundled components including **Bouncy Castle**, **Netty**, and **Apache ZooKeeper**. The advisories cover issues such as **LDAP injection** in BC-JAVA (`CVE-2026-0636`), **HTTP request smuggling** and **HTTP/2 denial of service** in Netty, and ZooKeeper flaws that could enable **information disclosure** and **reverse-DNS-spoofing-based impersonation**. Red Hat told customers to back up existing installations before applying the fixed releases from the Customer Portal. The updates also remediate a Bouncy Castle cryptographic flaw, `CVE-2025-14813`, in the **GOSTCTR** implementation, where keystream reuse after more than 255 blocks under the same key and IV can allow plaintext recovery from captured ciphertext. Red Hat rated that issue **Important** with a **CVSS 7.5** score and advised limiting encrypted payloads to 255 blocks per key/IV pair or moving to a stronger authenticated encryption mode until patched. The underlying weakness aligns with **CWE-327**, which covers the use of broken or risky cryptographic algorithms that can expose sensitive data and undermine system trust.
Aug 20, 2026
Apache disclosed **CVE-2026-48827**, a path traversal flaw in the `org.apache.sshd:sshd-git` bundle of Apache MINA SSHD that lets an SSH-authenticated user escape the configured Git root by supplying repository paths containing traversal sequences such as `../`. The issue affects `sshd-git` versions `2.0.0` through `2.17.1` and `3.0.0-M1` through `3.0.0-M3`, impacting `git-upload-pack`, `git-receive-pack`, and related operations. Successful exploitation can expose arbitrary Git repositories on the server filesystem and, in some cases, allow unauthorized writes outside the intended root. Apache fixed the bug in versions `2.18.0` and `3.0.0-M4` by adding centralized path validation, and noted that deployments using Apache MINA SSHD without the non-default `sshd-git` module are not affected. Apache also disclosed **CVE-2026-35563** in the Apache Directory LDAP API client, where versions `2.0.0` through `2.1.7` failed to verify whether a TLS server certificate matched the intended LDAP hostname. Because the client would accept a trusted certificate issued for an unrelated host, an attacker with man-in-the-middle network access could impersonate the LDAP server and fully compromise the connection. The flaw is tracked as `CWE-297`, and Apache said hostname verification is now enforced in a newer LDAP API release. The disclosures highlight two separate Apache security fixes affecting repository isolation in SSH-based Git services and certificate validation in LDAP client connections.
Jun 29, 2026