ZooKeeper 3.9.5 - Vulnerability Patch Status
==============================================

This package has been patched to address the following vulnerabilities:

FIXED VULNERABILITIES:
- GHSA-3p8m-j85q-pgmj: netty-codec upgraded to 4.2.17.Final ✓
- GHSA-389x-839f-4rhx: netty-common upgraded to 4.2.17.Final ✓
- GHSA-xq3w-v528-46rv: netty-common upgraded to 4.2.17.Final ✓
- GHSA-6mjq-h674-j845: netty-handler upgraded to 4.2.17.Final ✓
- GHSA-qp4g-569p-2xwl: jetty-http upgraded to 12.1.11 ✓
- GHSA-h46c-h94j-95f3: jackson-core upgraded to 2.22.2 ✓
- CVE-2026-54512/3/4/5: jackson-databind upgraded to 2.22.1 ✓
- GHSA-2r2c-cx56-8933/GHSA-47qp-hqvx-6r3f: jline upgraded to 4.2.1 ✓
- GHSA-55g7-9cwv-5qfv: snappy-java upgraded to 1.1.10.5 ✓
- GHSA-qcwq-55hx-v3vh: snappy-java upgraded to 1.1.10.5 ✓
- GHSA-fjpj-2g6w-x25r: snappy-java upgraded to 1.1.10.5 ✓
- GHSA-pqr6-cmr2-h8hf: snappy-java upgraded to 1.1.10.5 ✓
- GHSA-25qh-j22f-pwp8: logback-core upgraded to 1.5.36 ✓
- GHSA-w573-9ffj-6ff9: netty-transport-native-epoll upgraded to 4.2.17.Final ✓

KNOWN ISSUES:
- GHSA-7286-pgfv-vxvh: ZooKeeper core vulnerability - requires upgrade to 3.7.2+ (backport not feasible)
- GHSA-r978-9m6m-6gm6: ZooKeeper core vulnerability - requires code changes

Component versions after patching:
- netty-codec: 4.2.17.Final
- netty-common: 4.2.17.Final
- netty-handler: 4.2.17.Final
- jetty-http: 12.1.11
- jackson-core: 2.22.2
- jackson-databind: 2.22.1
- jline: 4.2.1
- snappy-java: 1.1.10.5
- logback-core: 1.5.36

Patch applied: Fri Sep  4 13:20:13 UTC 2026
Package version: 3.9.5-r8
