CVE-2026-59739

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>libzookeeper</name>
	<range><lt>3.8.7</lt></range>
      </package>
      <package>
	<name>zookeeper</name>
	<range><lt>3.8.7</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Information disclosure via SetWatches reconnect replay in Apache
	ZooKeeper due to missing ACL check. An attacker can discover
	ACL-restricted paths by registering exists-watches on non-existent
	paths, then reconnecting after the paths are created with restricted
	ACLs. Issue is caused by incomplete fix for CVE-2024-23944
	(ZOOKEEPER-4799). The fix added ACL checking to
	WatchManager.triggerWatch(). However, DataTree.setWatches() — the
	SetWatches/SetWatches2 reconnect replay handler — still calls
	watcher.process(event) with null ACL, bypassing the check entirely.
	It's important to note that only the path is exposed by this
	vulnerability, not the data of znode, but since znode path can contain
	sensitive information like user name or login ID, this issue is
	potentially critical.

Users are recommended to upgrade to version
	3.9.6, 3.8.7 which fixes the issue.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-59739</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-59739</url>
    </references>
    <dates>
      <discovery>2026-09-16</discovery>
      <entry>2026-10-25</entry>
    </dates>
  </vuln>