ZooKeeper 3.7.2 - Vulnerability Patch Status
==============================================

This package has been patched to address the following vulnerabilities:

FIXED VULNERABILITIES:
- CVE-2026-75595, CVE-2026-75596, CVE-2026-45416, CVE-2026-50010, CVE-2026-44249: netty-handler upgraded to 4.1.137.Final ✓
- CVE-2026-42583, CVE-2026-59901: netty-codec upgraded to 4.1.136.Final ✓
- CVE-2026-45536: netty-transport-native-epoll upgraded to 4.1.135.Final ✓
- GHSA-r7wm-3cxj-wff9: jackson-core upgraded to 2.18.8 ✓
- CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-59888: jackson-databind upgraded to 2.18.9 ✓
- CVE-2026-54515: jackson-databind upgraded to 2.18.9 ✓
- CVE-2026-10050: jetty-security upgraded to 12.1.10 ✓
- CVE-2026-6790, CVE-2026-10051: jetty-server upgraded to 12.1.10 ✓
- CVE-2026-8384: jetty-util upgraded to 12.1.9 ✓
- GHSA-3p8m-j85q-pgmj: netty-codec upgraded to 4.1.136.Final ✓
- GHSA-389x-839f-4rhx: netty-common upgraded to 4.1.137.Final ✓
- GHSA-xq3w-v528-46rv: netty-common upgraded to 4.1.137.Final ✓
- GHSA-6mjq-h674-j845: netty-handler upgraded to 4.1.137.Final ✓
- GHSA-qp4g-569p-2xwl: jetty-http upgraded to 12.1.10 ✓
- GHSA-h46c-h94j-95f3: jackson-core upgraded to 2.18.8 ✓
- GHSA-55g7-9cwv-5qfv: snappy-java upgraded to 1.1.10.5 ✓
- GHSA-qcwq-55hx-v3vh: snappy-java upgraded to 1.1.10.5 ✓
- GHSA-fjpj-2g6w-x25r: snappy-java upgraded to 1.1.10.5 ✓
- GHSA-pqr6-cmr2-h8hf: snappy-java upgraded to 1.1.10.5 ✓

KNOWN ISSUES:
- GHSA-7286-pgfv-vxvh: ZooKeeper core vulnerability - requires upgrade to 3.7.2+ (backport not feasible)
- GHSA-r978-9m6m-6gm6: ZooKeeper core vulnerability - requires code changes

Component versions after patching:
- netty-codec: 4.1.136.Final
- netty-common: 4.1.137.Final
- netty-handler: 4.1.137.Final
- netty-transport-native-epoll: 4.1.135.Final
- jetty-http: 12.1.10
- jetty-security: 12.1.10
- jetty-server: 12.1.10
- jetty-util: 12.1.9
- jackson-core: 2.18.8
- jackson-databind: 2.18.9
- snappy-java: 1.1.10.5

Patch applied: Sat Sep 19 23:05:52 UTC 2026
Package version: 3.7.2-r8
