ZooKeeper, Rails, Xen and Node.js security fixes

Multiple high-severity vulnerabilities were disclosed in core infrastructure projects. Apache ZooKeeper, Ruby on Rails, Xen, Node.js, OpenVox and Django all received patches for authorization bypass, remote code execution and denial-of-service flaws.

Apache ZooKeeper SASL authorization bypass

Apache ZooKeeper 3.8 and 3.9 contain CVE-2026-100252, a high-severity SASL authorization bypass on the client port. A client-supplied authorization ID can circumvent checks. Operators of ZooKeeper ensembles should apply the fix because the flaw undermines authentication boundaries.

Rails 8.0.5.2 and 8.1.4.1 security releases

Ruby on Rails issued security releases 8.0.5.2 and 8.1.4.1 that address 21 vulnerabilities. The set includes critical file-write and remote code execution flaws. Application maintainers need to upgrade to close these attack surfaces.

Xen grant-copy arbitrary read and write

Xen Security Advisory 523 v2 discloses CVE-2026-102703 and CVE-2026-102704 in grant-copy handling. A guest can obtain arbitrary read and write access that reaches Dom0. The issues affect Xen 4.6 and later, so hosts running those versions require the advisory updates.

Node.js security release with Brotli RCE

Node.js announced a security release that includes a high-severity Brotli remote code execution flaw. The vulnerability reaches many dependent projects such as Git, browsers and servers. Maintainers of those stacks should prepare for the coordinated update.

Apache ZooKeeper snapshot serialization DoS

Apache ZooKeeper published CVE-2026-115448 for unbounded recursion in snapshot serialization. A client can leave the server and its ensemble unrecoverable even after restart. The high-severity denial-of-service condition makes prompt patching essential for availability.

OpenVox RCE and client impersonation

OpenVox released patches for CVSS 9+ remote code execution and client impersonation vulnerabilities. The flaws affect all Puppet and OpenVox versions. Configuration-management deployments built on these tools need the updates to restore isolation.

Django coordinated security releases

Django published security releases that fix six CVEs spanning three branches: CVE-2026-108147, CVE-2026-111211, CVE-2026-111362, CVE-2026-113593, CVE-2026-113733 and CVE-2026-114582. Sites running the affected branches should move to the patched releases.

Apache ZooKeeper multiRead memory exhaustion

Apache ZooKeeper disclosed CVE-2026-100302, a high-severity denial of service caused by unbounded memory allocation in multiRead request handling. An attacker can exhaust heap resources on the server. Operators must apply the fix to prevent resource-exhaustion attacks.