CVE-2026-100235

Ranges per package from the CVE rows that match this port, in pkg notation with the port's epoch and revision, every bound checked with pkg; one range per epoch the port actually had. make newentry in security/vuxml creates the vid.

Copy to clipboard

  <vuln vid="FIXME (make newentry)">
    <topic>libzookeeper -- FIXME</topic>
    <affects>
      <package>
	<name>libzookeeper</name>
	<name>zookeeper</name>
	<range><ge>3.8.0</ge><le>3.8.7</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>CVE-2026-100235: Incorrect authorization due to a time-of-check to
	  time-of-use (TOCTOU) race condition in the setACL request handling
	  of Apache ZooKeeper. When a node's ACL is changed via setACL, the
	  pending change is not published to the server's outstanding change
	  record for that node. Any request that is prepared (and authorized)
	  after the setACL is submitted but before it commits is therefore
	  checked against the previous, pre-revocation ACL, yet is applied to
	  the data tree after the ACL change has taken effect. A client that
	  currently holds a permission can use this window to perform
	  operations requiring that permission through and after its
	  revocation — for example, committing writes or deletes after losing
	  write access, or re-granting itself full permissions, which
	  persistently defeats the revocation. In deployments transitioning
	  from the default OPEN_ACL_UNSAFE ACL to a restrictive ACL, any
	  unauthenticated client can exploit this during the transition. This
	  issue affects Apache ZooKeeper up to and including 3.9.6. Users are
	  recommended to upgrade to version 3.8.8 or 3.9.7, which fixes the
	  issue.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-100235</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-100235</url>
    </references>
    <dates>
      <discovery>2026-11-04</discovery>
      <entry>2026-11-04</entry>
    </dates>
  </vuln>