Apache CVE-2026-84501

EUVD-2026-80334 CRITICAL

Improper Output Neutralization for Logs (CWE-117)

2026-09-15

GHSA-mm24-r27q-hxg5

Apache Code Injection

Lifecycle Timeline

Analysis Generated

Sep 15, 2026 - 20:15 vuln.today

CVE Published

Sep 15, 2026 - 18:28 oss-security

CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News We need answer only title. Need generate concise SEO-friendly title. Format Critical/High [Vulnerability Type] in [Product] - [CVE-ID]. Product Apache? Summary says Apache ZooKeeper. Vulnerability log forgery / log injection. Severity CRITICAL. Max 100 chars. Need return ONLY title no quotes. Need decide title. "CVE-2026-84501", Product Apache ZooKeeper, vuln type Log Forgery/Log Injection. Title: "Critical Log Forgery in Apache ZooKeeper - CVE-2026-84501". Sep 16, 2026

AnalysisAI

Log forgery in Apache ZooKeeper 3.8.0–3.8.6 and 3.9.0–3.9.5 allows a remote client to inject arbitrary fake entries into the server's operational log by sending an add_auth("ensemble", ...) request whose ensemble name contains embedded newline characters. EnsembleAuthenticationProvider.handleAuthentication() writes the raw, unsanitized name through LOG.warn(), and because SLF4J's {} placeholder does not escape newlines, the attacker controls timestamp, level, class name and message text of the resulting lines. …