ZooKeeper 3.6.4 - Vulnerability Patch Status
==============================================

This package has been patched to address the following vulnerabilities:

FIXED VULNERABILITIES:
- CVE-2026-42583: netty-codec upgraded to 4.1.135.Final ✓
- GHSA-mj4r-2hfc-f8p6: netty-codec upgraded to 4.1.135.Final ✓
- CVE-2026-44249: netty-handler upgraded to 4.1.135.Final ✓
- CVE-2026-45416: netty-handler upgraded to 4.1.135.Final ✓
- CVE-2026-50010: netty-handler upgraded to 4.1.135.Final ✓
- GHSA-3qp7-7mw8-wx86: netty-handler upgraded to 4.1.135.Final ✓
- GHSA-x4gw-5cx5-pgmh: netty-handler upgraded to 4.1.135.Final ✓
- GHSA-c653-97m9-rcg9: netty-handler upgraded to 4.1.135.Final ✓
- CVE-2026-45536: netty-transport-native-epoll upgraded to 4.1.135.Final ✓
- GHSA-w573-9ffj-6ff9: netty-transport-native-epoll upgraded to 4.1.135.Final ✓
- CVE-2024-13009: jetty-server upgraded to 9.4.57.v20241219 ✓
- GHSA-3p8m-j85q-pgmj: netty-codec upgraded to 4.1.135.Final ✓
- GHSA-389x-839f-4rhx: netty-common upgraded to 4.1.135.Final ✓
- GHSA-xq3w-v528-46rv: netty-common upgraded to 4.1.135.Final ✓
- GHSA-6mjq-h674-j845: netty-handler upgraded to 4.1.135.Final ✓
- GHSA-qp4g-569p-2xwl: jetty-http upgraded to 9.4.57.v20241219 ✓
- GHSA-h46c-h94j-95f3: jackson-core upgraded to 2.18.9 ✓
- GHSA-rmj7-2vxq-3g9f: jackson-databind upgraded to 2.18.9 ✓
- GHSA-j3rv-43j4-c7qm: jackson-databind upgraded to 2.18.9 ✓
- CVE-2026-54512: jackson-databind upgraded to 2.18.9 ✓
- CVE-2026-54513: jackson-databind upgraded to 2.18.9 ✓
- GHSA-hgj6-7826-r7m5: jackson-databind upgraded to 2.18.9 ✓
- CVE-2026-54514: jackson-databind upgraded to 2.18.9 ✓
- CVE-2026-54515: jackson-databind upgraded to 2.18.9 ✓
- GHSA-3wrr-7qpf-2prh: jackson-databind upgraded to 2.18.9 ✓
- CVE-2026-50193: jackson-databind upgraded to 2.18.9 ✓
- GHSA-55g7-9cwv-5qfv: snappy-java upgraded to 1.1.10.5 ✓
- GHSA-qcwq-55hx-v3vh: snappy-java upgraded to 1.1.10.5 ✓
- GHSA-fjpj-2g6w-x25r: snappy-java upgraded to 1.1.10.5 ✓
- GHSA-pqr6-cmr2-h8hf: snappy-java upgraded to 1.1.10.5 ✓

KNOWN ISSUES:
- GHSA-7286-pgfv-vxvh: ZooKeeper core vulnerability - requires upgrade to 3.7.2+ (backport not feasible)
- GHSA-r978-9m6m-6gm6: ZooKeeper core vulnerability - requires code changes

Component versions after patching:
- netty-codec: 4.1.135.Final
- netty-common: 4.1.135.Final
- netty-handler: 4.1.135.Final
- netty-transport-native-epoll: 4.1.135.Final
- jetty-http: 9.4.57.v20241219
- jetty-server: 9.4.57.v20241219
- jackson-core: 2.18.9
- jackson-databind: 2.18.9
- snappy-java: 1.1.10.5

Patch applied: Thu Jul 16 00:59:35 UTC 2026
Package version: 3.6.4-r8
