CVE catalog

CVE-2025-58457

zookeeper affected and fixed versions

Improper permission check in ZooKeeper AdminServer lets authorized clients to run snapshot and restore command with insufficient permissions. This issue affects Apache ZooKeeper: from 3.9.0 before 3.9.4. Users are recommended to upgrade to version 3.9.4, which fixes the issue. The issue can be mitigated by disabling both commands (via admin.snapshot.enabled and admin.restore.enabled), disabling the whole AdminServer interface (via admin.enableServer), or ensuring that the root ACL does not provide open permissions. (Note that ZooKeeper ACLs are not recursive, so this does not impact operations on child nodes besides notifications from recursive watches.)

Severity: Medium · CVSS 4.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Published: Sep 24, 2025, 9:29:35 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.32% · Oct 27, 2026

Projects and upstream resources

[zookeeper][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiansid	zookeeper	`3.9.4-1`	FixedDistribution-reported fixed boundary	[CVE-2025-58457]
Debiansid	zookeeper	`3.9.6-2`	Fixed	[CVE-2025-58457]
Debianforky	zookeeper	`3.9.4-1`	FixedDistribution-reported fixed boundary	[CVE-2025-58457]
Debianforky	zookeeper	`3.9.6-2`	Fixed	[CVE-2025-58457]

Showing 4 fix observations. All 9 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
Debianbookworm	zookeeper	Not reported	Not affectedDistribution reports not affected	[CVE-2025-58457]
Debianbookworm	zookeeper	`3.8.0-11+deb12u2`	Not affected	[CVE-2025-58457]
Debianbookworm-security	zookeeper	`3.8.0-11+deb12u1`	Not affected	[CVE-2025-58457]
Debianforky	zookeeper	`3.9.4-1`	FixedDistribution-reported fixed boundary	[CVE-2025-58457]
Debianforky	zookeeper	`3.9.6-2`	Fixed	[CVE-2025-58457]
Debiansid	zookeeper	`3.9.4-1`	FixedDistribution-reported fixed boundary	[CVE-2025-58457]
Debiansid	zookeeper	`3.9.6-2`	Fixed	[CVE-2025-58457]
Debiantrixie	zookeeper	Not reported	AffectedDistribution reports no fix	[CVE-2025-58457]
Debiantrixie	zookeeper	`3.9.3-1+deb13u1`	Affected	[CVE-2025-58457]

Original provider fields

{
  "package_releases": [
    {
      "name": "zookeeper",
      "status": "fixed",
      "release": "sid",
      "version": "3.9.6-2"
    },
    {
      "name": "zookeeper",
      "status": "fixed",
      "release": "forky",
      "version": "3.9.6-2"
    },
    {
      "name": "zookeeper",
      "status": "vulnerable",
      "release": "trixie",
      "version": "3.9.3-1+deb13u1"
    },
    {
      "name": "zookeeper",
      "status": "not affected",
      "release": "bookworm",
      "version": "3.8.0-11+deb12u2"
    },
    {
      "name": "zookeeper",
      "status": "not affected",
      "release": "bookworm-security",
      "version": "3.8.0-11+deb12u1"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1116339,
      "name": "zookeeper",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "3.9.4-1"
    },
    {
      "bug": 1116339,
      "name": "zookeeper",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "3.9.4-1"
    },
    {
      "bug": 1116339,
      "name": "zookeeper",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": ""
    },
    {
      "bug": 1116339,
      "name": "zookeeper",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "unimportant",
      "fixed_version": "0"
    }
  ],
  "distribution_packages": []
}

[Debian bug #1116339]

Publisher notes

[trixie] zookeeper: Minor issue

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[libzookeeper-java]Unknown
Source package: [zookeeper]
Details (4)
- 3.8.0-11+deb12u2 · all · bookworm
  Not affected
  dsa · zookeeper · debian · bookworm
- 3.8.0-11+deb12u2 · all · bookworm
  Not affected
  dsa · zookeeper · debian · bookworm
- 3.8.0-11+deb12u1 · all · bookworm-security
  Not affected
  dsa · zookeeper · debian · bookworm
- 3.8.0-11+deb12u1 · all · bookworm-security
  Not affected
  dsa · zookeeper · debian · bookworm
[libzookeeper-java-doc]Unknown
Source package: [zookeeper]
Details (4)
- 3.8.0-11+deb12u2 · all · bookworm
  Not affected
  dsa · zookeeper · debian · bookworm
- 3.8.0-11+deb12u2 · all · bookworm
  Not affected
  dsa · zookeeper · debian · bookworm
- 3.8.0-11+deb12u1 · all · bookworm-security
  Not affected
  dsa · zookeeper · debian · bookworm
- 3.8.0-11+deb12u1 · all · bookworm-security
  Not affected
  dsa · zookeeper · debian · bookworm
[libzookeeper-mt2]Unknown
Source package: [zookeeper]
Details (4)
- 3.8.0-11+deb12u2 · amd64 · bookworm
  Not affected
  dsa · zookeeper · debian · bookworm
- 3.8.0-11+deb12u2 · arm64 · bookworm
  Not affected
  dsa · zookeeper · debian · bookworm
- 3.8.0-11+deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · zookeeper · debian · bookworm
- 3.8.0-11+deb12u1 · arm64 · bookworm-security
  Not affected
  dsa · zookeeper · debian · bookworm
[libzookeeper-mt-dev]Unknown
Source package: [zookeeper]
Details (4)
- 3.8.0-11+deb12u2 · amd64 · bookworm
  Not affected
  dsa · zookeeper · debian · bookworm
- 3.8.0-11+deb12u2 · arm64 · bookworm
  Not affected
  dsa · zookeeper · debian · bookworm
- 3.8.0-11+deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · zookeeper · debian · bookworm
- 3.8.0-11+deb12u1 · arm64 · bookworm-security
  Not affected
  dsa · zookeeper · debian · bookworm
[libzookeeper-st2]Unknown
Source package: [zookeeper]
Details (4)
- 3.8.0-11+deb12u2 · amd64 · bookworm
  Not affected
  dsa · zookeeper · debian · bookworm
- 3.8.0-11+deb12u2 · arm64 · bookworm
  Not affected
  dsa · zookeeper · debian · bookworm
- 3.8.0-11+deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · zookeeper · debian · bookworm
- 3.8.0-11+deb12u1 · arm64 · bookworm-security
  Not affected
  dsa · zookeeper · debian · bookworm
[libzookeeper-st-dev]Unknown
Source package: [zookeeper]
Details (4)
- 3.8.0-11+deb12u2 · amd64 · bookworm
  Not affected
  dsa · zookeeper · debian · bookworm
- 3.8.0-11+deb12u2 · arm64 · bookworm
  Not affected
  dsa · zookeeper · debian · bookworm
- 3.8.0-11+deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · zookeeper · debian · bookworm
- 3.8.0-11+deb12u1 · arm64 · bookworm-security
  Not affected
  dsa · zookeeper · debian · bookworm
[python3-zookeeper]Unknown
Source package: [zookeeper]
Details (4)
- 3.8.0-11+deb12u2 · amd64 · bookworm
  Not affected
  dsa · zookeeper · debian · bookworm
- 3.8.0-11+deb12u2 · arm64 · bookworm
  Not affected
  dsa · zookeeper · debian · bookworm
- 3.8.0-11+deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · zookeeper · debian · bookworm
- 3.8.0-11+deb12u1 · arm64 · bookworm-security
  Not affected
  dsa · zookeeper · debian · bookworm
[zookeeper]Unknown
Details (4)
- 3.8.0-11+deb12u2 · all · bookworm
  Not affected
  dsa · zookeeper · debian · bookworm
- 3.8.0-11+deb12u2 · all · bookworm
  Not affected
  dsa · zookeeper · debian · bookworm
- 3.8.0-11+deb12u1 · all · bookworm-security
  Not affected
  dsa · zookeeper · debian · bookworm
- 3.8.0-11+deb12u1 · all · bookworm-security
  Not affected
  dsa · zookeeper · debian · bookworm
[zookeeper-bin]Unknown
Source package: [zookeeper]
Details (4)
- 3.8.0-11+deb12u2 · amd64 · bookworm
  Not affected
  dsa · zookeeper · debian · bookworm
- 3.8.0-11+deb12u2 · arm64 · bookworm
  Not affected
  dsa · zookeeper · debian · bookworm
- 3.8.0-11+deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · zookeeper · debian · bookworm
- 3.8.0-11+deb12u1 · arm64 · bookworm-security
  Not affected
  dsa · zookeeper · debian · bookworm
[zookeeperd]Unknown
Source package: [zookeeper]
Details (4)
- 3.8.0-11+deb12u2 · all · bookworm
  Not affected
  dsa · zookeeper · debian · bookworm
- 3.8.0-11+deb12u2 · all · bookworm
  Not affected
  dsa · zookeeper · debian · bookworm
- 3.8.0-11+deb12u1 · all · bookworm-security
  Not affected
  dsa · zookeeper · debian · bookworm
- 3.8.0-11+deb12u1 · all · bookworm-security
  Not affected
  dsa · zookeeper · debian · bookworm

[Debian 13 (Trixie)]

[libzookeeper-java]Unknown
Source package: [zookeeper]
Details (2)
- 3.9.3-1+deb13u1 · all · trixie
  Affected
  dsa · zookeeper · debian · 13
- 3.9.3-1+deb13u1 · all · trixie
  Affected
  dsa · zookeeper · debian · 13
[libzookeeper-java-doc]Unknown
Source package: [zookeeper]
Details (2)
- 3.9.3-1+deb13u1 · all · trixie
  Affected
  dsa · zookeeper · debian · 13
- 3.9.3-1+deb13u1 · all · trixie
  Affected
  dsa · zookeeper · debian · 13
[libzookeeper-mt2]Unknown
Source package: [zookeeper]
Details (2)
- 3.9.3-1+deb13u1 · amd64 · trixie
  Affected
  dsa · zookeeper · debian · 13
- 3.9.3-1+deb13u1 · arm64 · trixie
  Affected
  dsa · zookeeper · debian · 13
[libzookeeper-mt-dev]Unknown
Source package: [zookeeper]
Details (2)
- 3.9.3-1+deb13u1 · amd64 · trixie
  Affected
  dsa · zookeeper · debian · 13
- 3.9.3-1+deb13u1 · arm64 · trixie
  Affected
  dsa · zookeeper · debian · 13
[libzookeeper-st2]Unknown
Source package: [zookeeper]
Details (2)
- 3.9.3-1+deb13u1 · amd64 · trixie
  Affected
  dsa · zookeeper · debian · 13
- 3.9.3-1+deb13u1 · arm64 · trixie
  Affected
  dsa · zookeeper · debian · 13
[libzookeeper-st-dev]Unknown
Source package: [zookeeper]
Details (2)
- 3.9.3-1+deb13u1 · amd64 · trixie
  Affected
  dsa · zookeeper · debian · 13
- 3.9.3-1+deb13u1 · arm64 · trixie
  Affected
  dsa · zookeeper · debian · 13
[python3-zookeeper]Unknown
Source package: [zookeeper]
Details (2)
- 3.9.3-1+deb13u1 · amd64 · trixie
  Affected
  dsa · zookeeper · debian · 13
- 3.9.3-1+deb13u1 · arm64 · trixie
  Affected
  dsa · zookeeper · debian · 13
[zookeeper]Unknown
Details (2)
- 3.9.3-1+deb13u1 · all · trixie
  Affected
  dsa · zookeeper · debian · 13
- 3.9.3-1+deb13u1 · all · trixie
  Affected
  dsa · zookeeper · debian · 13
[zookeeper-bin]Unknown
Source package: [zookeeper]
Details (2)
- 3.9.3-1+deb13u1 · amd64 · trixie
  Affected
  dsa · zookeeper · debian · 13
- 3.9.3-1+deb13u1 · arm64 · trixie
  Affected
  dsa · zookeeper · debian · 13
[zookeeperd]Unknown
Source package: [zookeeper]
Details (2)
- 3.9.3-1+deb13u1 · all · trixie
  Affected
  dsa · zookeeper · debian · 13
- 3.9.3-1+deb13u1 · all · trixie
  Affected
  dsa · zookeeper · debian · 13

Observed: Oct 24, 2026, 5:39:02 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]