Apache fixes flaws across ZooKeeper, OpenOffice and ActiveMQ

The Apache Software Foundation disclosed 35 security flaws across nine projects on 2–3 November 2026, affecting widely used tools such as ZooKeeper, OpenOffice, ActiveMQ and Juneau. The bulk of the issues are unpatched in some projects, with OpenOffice and Juneau receiving fixes and ZooKeeper and ActiveMQ slated for updates. The roundup notes 16 CVEs in total, with 5 rated high, 3 medium and 8 unrated, and states that no public exploitation has been confirmed at the time of reporting.

The most severe entry is CVE-2026-115448, scored 8.7, described as an unbounded recursion in snapshot serialization that can render a server unrecoverable; another 8.7 CVSS entry is CVE-2026-100300, an unauthenticated denial of service via quota-node data and paths that can crash the transaction-apply thread. CVE-2026-100252 (8.6) involves SASL authorization, potentially granting superuser access, while CVE-2026-100302 (7.1) can crash a server with a small remote request. The report also lists CVE-2026-100235 (6.0) as a race condition in ACL changes and several other flaws across the affected projects.

Notable impacts cover ZooKeeper configurations and coordination services, OpenOffice document handling flaws including PDF and memory-corruption vectors, and ActiveMQ’s broker flaws plus related NMS client issues; Juneau is noted for varied weaknesses in REST and parsing paths.

The analysis cites affected versions (ZooKeeper up to 3.8.7 and 3.9.6; OpenOffice 4.1.16 and earlier; ActiveMQ pre-6.4.0, 6.3.3 and 5.19.12; NMS ActiveMQ pre-2.3.0; HertzBeat 1.7.1–1.9.0; JClouds and Oozie all versions) and outlines fixes and mitigations, including upgrading ZooKeeper to 3.8.8 or 3.9.7, OpenOffice 4.1.17 and updating ActiveMQ and related components. The report stresses rapid patching of exposed systems and notes interim guidance to use access controls to mitigate ZooKeeper risks.