Apache ZooKeeper 3.7 end of life
Apache ZooKeeper 3.7 reached end of life on 2 February 2024, with 3.7.2 as its final release. Only the 3.8 and 3.9 lines still receive security fixes. ZooKeeper is stable enough that ensembles routinely run untouched for years, so the installed base sits well behind that line.
What now
Which vendors provide Apache ZooKeeper 3.7 security patches now that support has ended?
ZooKeeper EOL: Extended Support for 3.4 to 3.7 (Embedded)- End of life
- 2 February 2024
- Released
- Mar 2021
- Final release
- 3.7.2
- Successor
- ZooKeeper 3.8 or 3.9
Date published by Apache ZooKeeper release history, cross-checked against endoflife.date. We do not publish a lifecycle date we cannot source. Dates checked on zookeeper.apache.org and endoflife.date on 20 October 2026.
Last reviewed
Apache ZooKeeper versions: release and end-of-life dates
| Version | Released | End of life | Status |
|---|---|---|---|
| Apache ZooKeeper 3.7 (this page) | 17 Mar 2021 | 2 February 2024 | End of life |
| Apache ZooKeeper 3.6 | 25 Feb 2020 | 30 December 2022 | End of life |
| Apache ZooKeeper 3.5 | 3 May 2019 | 1 June 2022 | End of life |
| Apache ZooKeeper 3.4 | 22 Nov 2011 | 1 June 2020 | End of life |
End-of-life dates are published by each project and checked against endoflife.date.
What actually stops on 2 February 2024
- Security fixes for the 3.7 branch, including the bundled Netty, Jetty and logging libraries
- Any further 3.7.x releases
What actually breaks in the upgrade
Rolling upgrades work, if quorum holds
ZooKeeper supports replacing members one at a time with the ensemble continuously available. The constraint is not the ensemble, it is the version skew tolerated by every client above it — Kafka, Solr, HBase, NiFi, Hadoop — which is why the dependency map has to come before the first node is touched.
Kafka's KRaft migration does not remove the ensemble
Removing ZooKeeper from Kafka leaves every other dependent system exactly where it was. In most estates the non-Kafka ensembles are the older ones, precisely because they have had less attention.
Your options, costed honestly
Including the ones that do not involve buying anything from us.
| Option | What it is | Effort | Cost | Our view |
|---|---|---|---|---|
| Rolling upgrade to 3.8 or 3.9 | Replace members one at a time, quorum preserved. | Coordinated with every client system | Engineering time | The right destination, and achievable without downtime in most topologies. |
| OSSeva extended support | Patched 3.7.x builds. | Drop-in | Per ensemble | Secures the ensemble without requiring every dependent system to move at once. |
What OSSeva does for Apache ZooKeeper 3.7
OSSeva patches this line
OSSeva ships patched ZooKeeper 3.4, 3.6 and 3.7 (3.5 as custom support scoped per engagement) builds, including the bundled dependency set where most recent ZooKeeper advisories have originated.
Apache ZooKeeper extended support
Apache ZooKeeper extended support What your auditor will say
An ensemble holds the configuration and access-control state for the systems it coordinates, which places it in scope alongside them. Write access to ZooKeeper is effectively administrative access to the cluster above it.
Logical access control. Unrestricted four-letter-word commands and permissive ACLs on an ensemble are a recurring finding, and they are easy to demonstrate to an assessor.
Is Apache ZooKeeper 3.7 end of life?
Yes, since 2 February 2024. Before it, 3.6 ended on 30 December 2022, 3.5 on 1 June 2022 and 3.4 on 1 June 2020. Only 3.8 and 3.9 still receive upstream fixes.
Can an ensemble be upgraded without downtime?
Usually. ZooKeeper supports rolling upgrades when quorum is preserved, so members are replaced one at a time. The real constraint is the version skew tolerated by the clients above it, which is why the dependency inventory comes first.
Get a quote
Still running Apache ZooKeeper 3.7?
Tell us the versions and the estate size. We will tell you honestly whether to upgrade or to buy cover — and we say 'upgrade' more often than you would expect.
Prefer to talk or read more first?