OSSEVA FOR APACHE ZOOKEEPER
Every cluster depends on it. No team owns it.
ZooKeeper 3.7 reached end of life on 19 January 2024, 3.6 on 30 December 2022 and 3.5 on 1 June 2022. It is the quietest component in most architectures — which is why it is usually several years older than everything it coordinates.
Why now
Three ZooKeeper lines are past end of life
Upstream support ended for 3.4 on 1 June 2020, 3.5 on 1 June 2022, 3.6 on 30 December 2022 and 3.7 on 19 January 2024. Only 3.8 and 3.9 receive fixes. ZooKeeper is stable enough that ensembles routinely run untouched for five years, so the installed base sits well behind that line.
It holds the keys to everything it coordinates
An ensemble stores broker registration, topic configuration, ACLs, leader election state and often SASL credentials for the systems above it. Write access to ZooKeeper is effectively administrative access to the cluster it serves. Authentication bypass and information disclosure advisories in ZooKeeper are therefore rarely contained to ZooKeeper.
Kafka's move to KRaft leaves the rest of the estate behind
Kafka can now run without ZooKeeper, and the attention has followed. But Solr, HBase, NiFi, Hadoop and Druid still depend on it, and those ensembles inherit the same advisories with none of the migration momentum. Removing ZooKeeper from Kafka does not remove it from your estate.
Versions covered
All versions below receive active CVE patches from OSSeva. Version numbers in monospace are exact release identifiers.
| Version | Status | Active CVEs |
|---|---|---|
| 3.4.x(Community EOL 1 Jun 2020 — OSSeva patched) | EOL | Clean |
| 3.5.x(Community EOL 1 Jun 2022 — OSSeva patched) | EOL | Clean |
| 3.6.x(Community EOL 30 Dec 2022 — OSSeva patched) | EOL | Clean |
| 3.7.x(Community EOL 19 Jan 2024 — OSSeva patched) | EOL | Clean |
| 3.8.x(Upstream maintained) | Extended | Clean |
| 3.9.x(Upstream maintained) | Current | Clean |
What you get
Three tiers — pick the level of engagement that matches your team's operational needs and compliance requirements.
OSSeva Patch
CVE patches for ZooKeeper 3.4–3.7 past community end of life.
- Security backports for 3.4, 3.5, 3.6 and 3.7 ensembles
- Authentication bypass and ACL advisory priority coverage
- Transitive dependency patching (Netty, Jetty, log4j)
- Maven / Docker / tarball delivery
- Signed artifacts (GPG)
- Ensemble security audit
- 24/7 managed operations
OSSeva Assure
Patch plus ensemble audit across every system that depends on it.
- Everything in Patch
- Ensemble quorum and failure-domain review
- ACL, SASL and four-letter-word command exposure audit
- Dependency map of every system using the ensemble
- SOC 2 / HIPAA attestation package
- Rolling upgrade plan to 3.8 or 3.9
- 24/7 managed operations
OSSeva Operate
Full MSP: 24/7 ensemble monitoring, 15-min SLA, named engineers.
- Everything in Assure
- 24/7 quorum, latency and znode count monitoring
- 15-minute P1 incident response SLA
- Named senior distributed systems engineer
- Snapshot and transaction log retention management
- Rolling upgrade execution with quorum preserved
- Kafka KRaft migration assessment where applicable
All tiers priced per cluster/application — not per core. Contact for pricing →
How it installs
OSSeva artifacts arrive via your existing package infrastructure. Pull the patched version the same way you pull upstream today — just from the OSSeva registry.
# Version and mode of each ensemble member
echo srvr | nc zk1.internal 2181 | head -2
echo srvr | nc zk2.internal 2181 | head -2
echo srvr | nc zk3.internal 2181 | head -2
# Anything on 3.7 or below receives no upstream security fixes.
# Confirm the four-letter-word commands are restricted —
# an unrestricted 'wchp' or 'dump' leaks topology and client state
echo dump | nc zk1.internal 2181 | head -5<dependency>
<groupId>io.osseva.zookeeper</groupId>
<artifactId>zookeeper</artifactId>
<version>3.7.2-osseva-1</version>
</dependency>
<dependency>
<groupId>io.osseva.zookeeper</groupId>
<artifactId>zookeeper-jute</artifactId>
<version>3.7.2-osseva-1</version>
</dependency>Migrate from Unsupported community ZooKeeper ensembles
OSSeva ships patched builds on the 3.4 through 3.7 lines so ensembles can be secured without a coordinated upgrade of every system that registers with them. Where an upgrade to 3.8 or 3.9 is viable, OSSeva plans and executes it as a rolling change with quorum maintained throughout.
Pricing model
OSSeva for ZooKeeper is priced per ensemble — not per node or per client connection.
Frequently asked questions
Which versions of RabbitMQ are past community end-of-life?
RabbitMQ 3.8.x, 3.9.x, 3.10.x, 3.11.x, and 3.12.x have all reached community EOL — meaning no further security patches or CVE fixes are released by the RabbitMQ maintainers for those versions. RabbitMQ 3.13.x reached EOL in late 2024. OSSeva delivers backported CVE patches for 3.11 through 3.13.
Which PostgreSQL versions are no longer receiving community security patches?
PostgreSQL 9.6 through 13 have all reached community EOL. PostgreSQL 11 reached EOL November 2023, PostgreSQL 12 reached EOL November 2024, and PostgreSQL 13 reaches EOL November 2025. OSSeva provides extended security patching for PostgreSQL 11, 12, and 13 for teams that cannot immediately migrate to PG 14 or later.
Is Spring Framework 5.3.x still supported?
Spring Framework 5.3.x reached its community OSS EOL on December 31, 2024. Broadcom's commercial support for Spring 5.3.x is also no longer available under standard terms. OSSeva delivers backported CVE patches for Spring Framework 5.3.x and Spring Boot 2.7.x under our extended lifecycle support program.
Which versions of Apache Kafka are EOL?
Apache Kafka versions 2.x and 3.0 through 3.4 are past their community supported window, meaning no further patch releases. Kafka 3.5 and 3.6 have reached or are approaching EOL. OSSeva supports Kafka 2.8 through 3.5 with backported security patches and compliance documentation.
What happened to Redis licensing? Can I still use Redis for free?
In March 2024, Redis Ltd. changed the Redis license from BSD-3-Clause to the Business Source License (BSL 1.1), which restricts use in competing database products. The Valkey project (a Linux Foundation fork) continues under BSD-3-Clause. OSSeva maintains BSD-licensed, CVE-patched builds of Redis 6.2 and 7.0 for enterprises that need verifiable open-source licensing alongside security coverage.
Is Node.js 18 still receiving security patches?
Node.js 18 (LTS 'Hydrogen') reached its end-of-life date in April 2025 and no longer receives security releases from the Node.js project. OSSeva delivers CVE patches for Node.js 18 for enterprise teams that have not yet migrated to Node.js 20 or 22.
Is Apache Tomcat 8.5 still supported?
Apache Tomcat 8.5 reached its community EOL in March 2024. OSSeva provides extended security patching for Tomcat 8.5.x for teams running Java EE 7 workloads that cannot immediately migrate to Tomcat 9.0 or 10.1.
What .NET versions does OSSeva support?
.NET 6 reached Microsoft end-of-support in November 2024. .NET 7 reached EOL in May 2024. OSSeva delivers CVE patches for .NET 6 and .NET 7 for teams that have not yet migrated to .NET 8 (LTS, supported through November 2026).
Ready to get Apache ZooKeeper patched and supported?
Start with a 45-minute discovery call. We confirm your version coverage, scope the engagement, and have you onboarded within your first quarter.