Apache Vulnerabilities in ZooKeeper, OpenOffice, ActiveMQ and Juneau Get Fixes
Do Son 
TL;DR
The Apache Software Foundation disclosed 35 security flaws across nine projects on November 2 and 3, 2026. These Apache vulnerabilities hit widely used tools, including Apache ZooKeeper, Apache OpenOffice, ActiveMQ and Juneau. Twenty of them carry a high severity rating.
Three ZooKeeper bugs score up to 8.7 on CVSS and can crash servers or grant superuser access. OpenOffice 4.1.17 fixes 12 more document-parsing flaws, while ActiveMQ and Juneau receive their own fixes. Two retired projects, JClouds and Oozie, will never get patches.
- Total: 16 CVEs
- Severity: 5 High · 3 Medium · 8 Unrated
- Actively exploited: None confirmed
- Highest severity: 8.7 (High · CVSSv4) — CVE-2026-115448
- Action: Apply the latest security updates now
Notable CVEs
| CVE | CVSS (CVSSv4) | Type | Status |
|---|---|---|---|
| CVE-2026-115448 | 8.7 | Unbounded recursion in snapshot serialization allows a client to render the server unrecoverable | Not exploited |
| CVE-2026-100300 | 8.7 | Unauthenticated persistent denial of service via unvalidated quota-node data and paths crashing the transaction-apply thread | Not exploited |
| CVE-2026-100252 | 8.6 | SASL authorization bypass on the client port through a client-supplied authorization ID | Not exploited |
| CVE-2026-90628 | 7.3 | CWE-121 | Not exploited |
| CVE-2026-100302 | 7.1 | Denial of service through unbounded memory allocation in multiRead request handling | Not exploited |
| CVE-2026-100235 | 6 | ACL enforcement bypass allows unauthorized operations to commit after an ACL revocation | Not exploited |
| CVE-2026-90627 | 5.5 | CWE-552 | Not exploited |
| CVE-2026-90632 | 5.5 | CWE-552 | Not exploited |
Why It Matters
Apache ZooKeeper coordinates many large distributed systems, such as Kafka and Hadoop clusters. A single crash or data-loss bug there can ripple across an entire environment. Meanwhile, OpenOffice bugs reach ordinary desktop users through booby-trapped documents.
So far, no exploitation in the wild has been confirmed for any of these Apache vulnerabilities. CVE Watchtower also shows no public proof-of-concept for them.
By the numbers
- OpenOffice: 12 flaws (9 high, 2 medium, 1 low)
- Juneau: 9 flaws (4 high, 4 medium, 1 low)
- ZooKeeper: 5 flaws (4 high, 1 medium)
- ActiveMQ: 5 broker flaws, plus 1 low-severity flaw in the .NET NMS client
- HertzBeat, JClouds and Oozie: 1 flaw each
How the Attacks Work
Apache ZooKeeper
CVE-2026-115448 (CVSS 8.7) abuses deep znode trees. The server writes snapshots by recursing “one stack frame per znode level, with no depth bound.” Because the default root ACL is open, any client may create such a tree. The advisory warns of potential data loss that “can spread across an ensemble.”
Next, CVE-2026-100300 (CVSS 8.7) targets the quota subsystem. On default deployments, attackers can write to the quota subtree without logging in. A successful attack can crash the request thread and leave the data directory “permanently unbootable.” Meanwhile, CVE-2026-100252 (CVSS 8.6) affects SASL setups. The server grants any authorization identity a client requests. If that identity matches a configured superuser, the client “gets superuser access to the whole data tree.”
In addition, CVE-2026-100302 (CVSS 7.1) lets a remote attacker crash the server “with a single small request.” Finally, CVE-2026-100235 (CVSS 6.0) is a race condition in ACL changes.
Apache OpenOffice
Most OpenOffice bugs involve crafted PDF, WMF, DXF or Word files that corrupt memory. One PDF export flaw, CVE-2026-90628, could even lead to “running other code.” Others leak data. For example, CVE-2026-90627 lets a document “read the contents of any local file without asking the user.” Similarly, CVE-2026-90632 abuses the GStreamer media component to pull in local files.
ActiveMQ and Juneau
ActiveMQ broker bugs mainly affect authenticated clients. For example, CVE-2026-108946 lets one client spoof another user’s IDs and read from that connection’s temporary queues. Other ActiveMQ flaws can exhaust memory or keep revoked write access alive. Juneau’s flaws are more varied. For instance, its REST client leaked credential headers on cross-host redirects. Its server also logged Authorization and Cookie headers in cleartext after errors. A MessagePack parsing bug let “a request body of a few bytes” force huge memory allocations.
Retired and smaller projects
HertzBeat contains an XPath validation gap that can burn CPU. JClouds has an XML entity expansion bug, and Oozie lets one user hijack another tenant’s workflow job.
Affected Versions
- ZooKeeper: up to 3.8.7 and 3.9.6; the multiRead bug affects 3.7.0 and later
- OpenOffice: 4.1.16 and earlier
- ActiveMQ: releases before 6.4.0, 6.3.3 and 5.19.12
- NMS ActiveMQ: before 2.3.0
- HertzBeat: 1.7.1 through 1.9.0
- JClouds and Oozie: all versions
Patch and Mitigation
- Upgrade Apache ZooKeeper to 3.8.8 or 3.9.7. The multiRead fix ships only in 3.9.7.
- Install OpenOffice 4.1.17, which Apache released on October 14.
- Move ActiveMQ to 6.4.0, 6.3.3 or 5.19.12, and NMS ActiveMQ to 2.3.0.
- Update HertzBeat to 1.9.1, and check the Juneau security page for its fixed release.
- Replace JClouds and Oozie, or limit them to trusted users.
As a stopgap for ZooKeeper, the project advises using “ACLs and authentication to restrict znode creation rather than relying on the default open root ACL.” Overall, these Apache vulnerabilities reward quick patching of exposed coordination and messaging servers.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
