{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f46f8101-4a70-5376-87c3-7c8379b77de9", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "zookeeper", "purl": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.14-tuxcare.1", "type": "library", "group": "org.apache.zookeeper", "bom-ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.14-tuxcare.1", "version": "3.4.14-tuxcare.1", "pedigree": { "ancestors": [ { "name": "zookeeper", "purl": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.14", "type": "library", "group": "org.apache.zookeeper", "version": "3.4.14" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2017-5637", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:b2ee77c5-7a28-5f9c-8494-26568f0fb112", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5637 does not affect version 3.4.14-tuxcare.1 of org.apache.zookeeper:zookeeper. ZooKeeper 3.4.14 is not vulnerable as it is higher than upstream fix version - 3.4.10", "justification": "code_not_present" } }, { "id": "CVE-2018-8012", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:bbeba16c-dccf-54e0-83d1-5d9f72ebc574", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-8012 does not affect version 3.4.14-tuxcare.1 of org.apache.zookeeper:zookeeper. ZooKeeper 3.4.14 is not vulnerable as it is higher than upstream fix version - 3.4.10", "justification": "code_not_present" } }, { "id": "CVE-2019-0201", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:db045ebe-6448-530d-a400-574d4b353a65", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-0201 does not affect version 3.4.14-tuxcare.1 of org.apache.zookeeper:zookeeper. not_affected \u2014 CVE-2019-0201 is NOT present in the target repository. The upstream Apache ZooKeeper 3.4.14 release already contained the security fix (commit 5ff19e3672987bdde2843a3f031e2bf0010e35f1 by Andor Molnar from Apache) before TuxCare onboarded this version. The fix adds permission checking (READ or ADMIN required) to the getACL() operation and masks digest authentication hashes unless the requester h...", "justification": "code_not_present" } }, { "id": "CVE-2023-44981", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:38273255-27f9-5837-906f-741e5372adb6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44981 is fixed in version 3.4.14-tuxcare.1 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2024-23944", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:0ebbacd6-5e34-5198-82f2-0008a51573eb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-23944 does not affect version 3.4.14-tuxcare.1 of org.apache.zookeeper:zookeeper. not_affected \u2014 CVE-2024-23944 describes information disclosure via persistent recursive watchers that reveal descendant znode paths to clients lacking READ permission. Version 3.4.14 is NOT AFFECTED because persistent watchers (including the addWatch command and PERSISTENT_RECURSIVE mode) were only introduced in ZooKeeper 3.6.0 (November 2019), after version 3.4.14 was released. While 3.4.14 contains the unde...", "justification": "code_not_reachable" } }, { "id": "CVE-2024-51504", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:db83a18f-bb48-5ccb-aaa0-fc259fa61d86", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-51504 does not affect version 3.4.14-tuxcare.1 of org.apache.zookeeper:zookeeper. Prechecker: No vulnerable code from the fix was found; this version has none of the entry points of the fix's regression test, and the functions the fix changes do not exist in it. Version 3.4.14 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-g93m-8x6h-g5gv (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only).", "justification": "code_not_present" } }, { "id": "CVE-2025-58457", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:5f2af1e7-0429-5339-a973-e60b5ef581bd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-58457 does not affect version 3.4.14-tuxcare.1 of org.apache.zookeeper:zookeeper. not_affected \u2014 The target version 3.4.14 is not affected by CVE-2025-58457. The vulnerability concerns improper permission checks in the AdminServer component for snapshot and restore commands, but AdminServer was not introduced until ZooKeeper 3.5.0. Version 3.4.14 predates this feature entirely, so the vulnerable code path does not exist. While the underlying checkACL method in 3.4.14 has similar bitwise lo...", "justification": "code_not_present" } }, { "id": "CVE-2026-100235", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:27f88e53-d52f-56fb-901e-1666d228a6cf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-100235 affects version 3.4.14-tuxcare.1 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-100252", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:26b55c84-d358-5203-92fe-3bd4a8b19c2f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-100252 affects version 3.4.14-tuxcare.1 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-100300", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:de77239a-ff9d-5558-9df8-3d90aaa7abe7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-100300 affects version 3.4.14-tuxcare.1 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-100302", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:1b19acf3-5285-5ce8-89aa-a3d307ae1b3e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-100302 does not affect version 3.4.14-tuxcare.1 of org.apache.zookeeper:zookeeper. not_affected \u2014 Target is ZooKeeper 3.4.14. The multi operation here supports only write and check sub-ops (create, delete, setData, check). There is no multiRead handler, no read sub-ops (getData/getChildren), and no OpCode.multiRead, so a small request cannot amplify into a large in-memory response. The CVE lists 3.7.0 to 3.9.6 as affected, and the multiRead feature does not exist in this codebase.", "justification": "code_not_reachable" } }, { "id": "CVE-2026-115448", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:689f611c-3d65-5306-ab0c-7b5594c0b1d1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-115448 affects version 3.4.14-tuxcare.1 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-24281", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:41d3c8c4-8520-5119-9721-8e3d351b4cab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24281 affects version 3.4.14-tuxcare.1 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-24308", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:33b80d69-a73a-57de-b587-67cd608f837c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24308 affects version 3.4.14-tuxcare.1 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-59739", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:9833f277-f54a-5ebb-ba21-ea4a5d7a1cdf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59739 affects version 3.4.14-tuxcare.1 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-59969", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:ab0f3fc9-87ae-5443-8354-c6e14a90578d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59969 does not affect version 3.4.14-tuxcare.1 of org.apache.zookeeper:zookeeper. not_affected \u2014 Apache ZooKeeper version 3.4.14 is NOT AFFECTED by CVE-2026-59969. The vulnerability affects the quorum TLS hostname verification implementation in FIPS mode, but this feature does not exist in version 3.4.14. The quorum TLS feature was introduced in version 3.5.x (ZOOKEEPER-3176, added 85 commits after release-3.5.4 in January 2019), while version 3.4.14 is from the older 3.4.x branch. Exhaust...", "justification": "code_not_present" } }, { "id": "CVE-2026-79993", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:398e106e-5d10-5412-9de0-f760348a4004", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-79993 does not affect version 3.4.14-tuxcare.1 of org.apache.zookeeper:zookeeper. not_affected \u2014 ZooKeeper 3.4.14 is not affected by CVE-2026-79993. The vulnerability concerns the deleteContainer opcode (0x14/20) bypassing ACL permission checks, but version 3.4.14 predates the container node feature entirely. The OpCode interface (ZooDefs.java) does not define deleteContainer (opcode 20), CreateMode enum lacks the CONTAINER node type, and no DeleteContainerRequest class exists. Analysis of...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-84439", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:6c9d5a22-8a11-5626-a94d-55e85d5fa487", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-84439 does not affect version 3.4.14-tuxcare.1 of org.apache.zookeeper:zookeeper. not_affected \u2014 Apache ZooKeeper 3.4.14 is not affected by CVE-2026-84439 because the audit logging feature does not exist in this version. The vulnerability targets audit log serialization in the AuditEvent class, which was introduced in version 3.6.0 (ZOOKEEPER-1260). The target version 3.4.14 predates this feature by several major releases. Without audit logging, there are no audit log entries for attackers...", "justification": "code_not_present" } }, { "id": "CVE-2026-84501", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:1a6d077d-c3e1-51fd-a0a9-1e66f45d4a20", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-84501 does not affect version 3.4.14-tuxcare.1 of org.apache.zookeeper:zookeeper. not_affected \u2014 Apache ZooKeeper version 3.4.14 does not contain the vulnerable code pattern for CVE-2026-84501. The EnsembleAuthenticationProvider class and ensemble authentication mechanism did not exist in this version - they were introduced later in version 3.6.0 (commit dc9097247, ZOOKEEPER-3239). Since the target cannot receive ensemble names in authentication requests, there is no code path where attack...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.14-tuxcare.1" } ] }