The Apache Software Foundation disclosed 35 vulnerabilities across nine projects on 2 and 3 November, 20 of them rated high. The affected software includes ZooKeeper, OpenOffice, ActiveMQ and Juneau, and no exploitation or public proof-of-concept code has been confirmed. Two retired projects will not receive fixes.
Five ZooKeeper Flaws Threaten Crashes, Data Loss and Identity Spoofing
ZooKeeper, the coordination service that distributed systems use for configuration and leader election, received the most severe entries.
CVE-2026-115448 and CVE-2026-100300 Both Score CVSS 8.7
CVE-2026-115448 involves deep znode trees. Snapshot writing recurses one stack frame per level of depth, which risks data loss. CVE-2026-100300 lets an unauthenticated user write to quota subtrees in a way that can crash the server and leave the data directory unbootable.
CVE-2026-100252 Lets SASL Setups Grant Any Requested Identity
CVE-2026-100252, rated CVSS 8.6, affects SASL configurations that grant any identity a client requests, including a superuser identity. Two lower-rated flaws round out the group: CVE-2026-100302 (CVSS 7.1), where a single small request can crash the server, and CVE-2026-100235 (CVSS 6.0), an ACL race condition. As a stopgap, administrators can restrict znode creation with ACLs and authentication.
OpenOffice 4.1.17 Fixes 12 Document-Parsing Flaws
Apache OpenOffice 4.1.17 resolves 12 document-parsing flaws. CVE-2026-90628, in PDF export, could lead to code execution. CVE-2026-90627 and CVE-2026-90632 leak local files. Users of the desktop office suite should update to 4.1.17.
ActiveMQ and Juneau Expose User Identities and Credentials
In ActiveMQ, CVE-2026-108946 lets a client spoof another user’s IDs and read temporary queues. Other ActiveMQ flaws exhaust memory or let a user keep revoked write access. Temporary queues in a message broker often carry replies addressed to one specific client, so spoofing that client’s ID gives another user a view of traffic meant for someone else. A user who keeps write access after revocation defeats the purpose of removing the permission.
Juneau has three issues. Its REST client leaks credential headers on cross-host redirects, its server logs Authorization and Cookie headers in cleartext, and a MessagePack parsing flaw acts as a memory bomb. Logging of Authorization headers in cleartext puts credentials in files that administrators and log-collection systems routinely read.
HertzBeat, JClouds and Oozie Complete the Disclosure Batch
HertzBeat has an XPath flaw that burns CPU. JClouds is vulnerable to XML entity expansion. Oozie has a cross-tenant workflow hijack flaw.
JClouds and Oozie Are Retired and Will Not Be Patched
JClouds and Oozie are retired Apache projects, and the foundation will not release fixes for them. Users who still run either one have no patch to apply for these flaws.
ZooKeeper and ActiveMQ Servers Carry the Main Exposure
Of the 35 flaws, 20 are rated high, which puts more than half of the batch at that severity level.
The batch touches coordination and messaging servers that sit behind many data platforms, as well as desktop office installations. The consequences range from crashes and data leaks to code execution in the OpenOffice PDF export path. None of the issues has a confirmed exploitation record, and no public proof-of-concept code has been reported.
The unauthenticated quota-subtree write in ZooKeeper and the SASL identity flaw stand out within the group because they involve access control rather than resource exhaustion. A server that hands out a superuser identity on request, or one that an unauthenticated user can render unbootable, affects every service that relies on it for coordination.
The retired-project entries present a distinct problem. Disclosing vulnerabilities in JClouds and Oozie without patches leaves their users to migrate to another tool or accept the risk, since the foundation has stated that no fixes will follow. All other affected projects should be updated to their fixed releases.
