Advisory Review, Q3 2026: Spring, NiFi, ZooKeeper and Erlang/OTP

How this review is assembled

Every advisory below is CPE-matched at NVD against the product's own CPE — not found by keyword search. That distinction matters more than it sounds: a keyword search for "zookeeper" returns Hadoop YARN and Apache Dubbo flaws that merely mention it, and publishing those as ZooKeeper advisories is how vulnerability directories lose their credibility. Identifiers, scores and dates below are copied from the upstream record and are checkable at nvd.nist.gov/vuln/detail/{id}.

This is a review of the quarter, not a monthly newsletter. We would rather publish when there is something worth reading than commit to a cadence and fill it.

Spring Framework: six advisories, one day

On 27 August 2026, six advisories were published against Spring Framework, five of them at CVSS 9.8:

Read them together and a pattern emerges that matters more than any single entry: they concentrate in XML processing and in the functional web framework. If your applications use the functional endpoint style, or process XML anywhere in the request path, this set is not a routine dependency bump.

The SpEL entry is the one we expect to be most often dismissed. Teams read "Spring Expression Language" and assume it means someone wrote a SpEL expression deliberately. In practice SpEL evaluation turns up in annotation values, in property placeholders, and in library code that consumes them — which is why this class keeps recurring across Spring's history.

The awkward part for anyone on 5.3.x: Spring Framework 5.3 reached OSS end of life on 31 August 2024. Fixes move to a commercial subscription rather than being published for the open branch. Six critical advisories in a day is a bad quarter for a supported line. On an unsupported one it is a different kind of problem.

Apache NiFi: authorization, not injection

Two advisories on 3 August 2026, both worth reading closely because neither is the kind of flaw a scanner explains well.

• CVE-2026-68979 (9.8) — Apache NiFi 1.10.0 through 2.10.0 expose a Parameter Context update REST method that does not enforce authorization on components referencing those parameter values. Framework authorization was limited to read and write on the Parameter Context itself, so a user authorised to change a context but not the components using it could alter values those components depend on. Where a parameter value contains executable scripting content, that becomes code execution.
• CVE-2026-68980 (9.1) — affects NiFi 2.0.0 through 2.10.0.

The version range on the first is the detail to notice: 1.10.0 through 2.10.0. It spans the 1.x line and most of 2.x. Teams who migrated to NiFi 2 to get back onto a supported release are inside this range too — migration was the right move for many reasons, but it did not exempt anyone here.

For anyone still on 1.x, there is no fix coming. The 1.x line ended at 1.28.1 on 19 November 2024, and this advisory reaches every version of it from 1.10 onward. If a NiFi 2 migration was already on the roadmap, this is the argument for moving it up. Our NiFi 1.x to 2.0 guide covers the required step through 1.27.0 and what 2.0 removed.

Apache ZooKeeper: three in one day

On 16 September 2026, three advisories at CVSS 7.5 each:

• CVE-2026-59739 — information disclosure via SetWatches reconnect replay.
• CVE-2026-59969 — quorum TLS fails to enforce peer hostname verification.
• CVE-2026-79993 — the deleteContainer opcode is processed without verification.

None is a 9.8, and that is precisely why they deserve attention rather than triage-by-score. Consider what an ensemble actually holds: broker registration, topic configuration, ACLs, leader election state, and in many deployments SASL credentials for the systems above it. Information disclosure there is disclosure about the cluster it coordinates. A quorum TLS check that does not verify peer hostname weakens the boundary that keeps an unauthorised member out of the ring — and a member that can join is inside the trust boundary.

ZooKeeper is also the component most likely to be years behind in any given estate, because it is stable enough to generate no tickets. Only 3.8 and 3.9 receive fixes. 3.7 ended on 19 January 2024, 3.6 on 30 December 2022 and 3.5 on 1 June 2022.

One thing worth saying plainly: Kafka's move to KRaft removes the ensemble from Kafka and from nothing else. Solr, HBase, NiFi, Hadoop and Druid still coordinate through ZooKeeper, and in most estates those ensembles are the older ones because they have had less attention.

Erlang/OTP: a steady quarter, which is the story

Four advisories reached the runtime this quarter, including CVE-2026-49759 (8.2, a stack-based buffer overflow in erts), CVE-2026-55952 (7.5, the ssl application failing to validate a PSK identity), CVE-2026-42792 and CVE-2026-54890 (7.5, an integer underflow).

No single entry here is dramatic. The pattern is. This is a normal quarter for Erlang/OTP, and it is why our exposure study found 22 CVE records disclosed against OTP 24 after its end-of-life date — nine of them CVSS 7.0 or higher — against none for RabbitMQ itself over the same period.

If you run RabbitMQ and your version inventory records the broker without the runtime, it is recording the half with fewer advisories. And because RabbitMQ 3.11, 3.12 and 3.13 are each capped at an Erlang release that has since gone end of life, the runtime cannot be patched forward without a broker migration.

Apache ActiveMQ

CVE-2026-45505 (8.8) was published on 1 June 2026 — improper input validation and improper control of generation of code. Apache ships Classic fixes on the current 5.19.x line and on 6.x only; brokers on 5.15 through 5.18 receive nothing. That installed base is the one CVE-2023-46604 was exploited against by ransomware operators within days of disclosure, which remains the clearest illustration of what an unpatched broker line costs.

What to do with this

1. Check the NiFi range first. 1.10.0 through 2.10.0 is unusually wide and catches teams who believe they are current.
2. If you run Spring 5.3.x, read the August set properly rather than scanning the scores. The XML and functional-endpoint concentration tells you where to look in your own code.
3. Find out how old your ZooKeeper ensembles are. Not the Kafka one — the others. echo srvr | nc zk1 2181 takes seconds and the answer is routinely a surprise.
4. Record broker and runtime as a pair. An inventory that stops at the application layer misses where the advisories are.

Every advisory referenced here has a page in our vulnerability directory with its affected version range as NVD publishes it.