DEBIAN-CVE-2026-100235

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-100235
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-100235.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-100235
Upstream
  • CVE-2026-100235
Published
2026-11-04T11:17:04Z
Modified
2026-11-06T15:01:04Z
Severity
  • 6.0 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
Summary
[none]
Details

Incorrect authorization due to a time-of-check to time-of-use (TOCTOU) race condition in the setACL request handling of Apache ZooKeeper. When a node's ACL is changed via setACL, the pending change is not published to the server's outstanding change record for that node. Any request that is prepared (and authorized) after the setACL is submitted but before it commits is therefore checked against the previous, pre-revocation ACL, yet is applied to the data tree after the ACL change has taken effect. A client that currently holds a permission can use this window to perform operations requiring that permission through and after its revocation — for example, committing writes or deletes after losing write access, or re-granting itself full permissions, which persistently defeats the revocation. In deployments transitioning from the default OPEN_ACL_UNSAFE ACL to a restrictive ACL, any unauthenticated client can exploit this during the transition. This issue affects Apache ZooKeeper up to and including 3.9.6. Users are recommended to upgrade to version 3.8.8 or 3.9.7, which fixes the issue.

References

Affected packages

Debian:12 / zookeeper

Package

Name
zookeeper
Purl
pkg:deb/debian/zookeeper?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.8.0-11
3.8.0-11+deb12u1
3.8.0-11+deb12u2
3.9.1-1
3.9.2-1
3.9.2-2
3.9.3-1
3.9.3-2
3.9.4-1
3.9.4-2
3.9.5-1
3.9.5-2
3.9.6-1
3.9.6-2
3.9.6-3

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-100235.json"

Debian:13 / zookeeper

Package

Name
zookeeper
Purl
pkg:deb/debian/zookeeper?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.9.3-1
3.9.3-1+deb13u1
3.9.3-2
3.9.4-1
3.9.4-2
3.9.5-1
3.9.5-2
3.9.6-1
3.9.6-2
3.9.6-3

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-100235.json"

Debian:14 / zookeeper

Package

Name
zookeeper
Purl
pkg:deb/debian/zookeeper?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.9.3-1
3.9.3-2
3.9.4-1
3.9.4-2
3.9.5-1
3.9.5-2
3.9.6-1
3.9.6-2
3.9.6-3

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-100235.json"