[
https://issues.apache.org/jira/browse/ZOOKEEPER-5038?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18078225#comment-18078225
]
Lari Hotari commented on ZOOKEEPER-5038:
----------------------------------------
Since the recurring blocker for upgrading Jetty is the Java baseline (Jetty 12
requires Java 17, while ZooKeeper still supports Java 8/11), it would be useful
to decouple the HTTP admin server from {{zookeeper-server}} entirely.
Concretely, the {{org.apache.zookeeper.server.admin}} package could be moved
out of the {{zookeeper-server}} module into a new, separate module — for
example {{{}zookeeper-server-http-admin{}}}. The rest of ZooKeeper would keep
its current Java 8/11 compatibility, and only this optional module would
require Java 17 (and pull in Jetty 12).
To avoid a hard compile-time dependency from {{zookeeper-server}} on the new
module, the admin server could be loaded via reflection at runtime when it is
enabled in the configuration. That way users on older JDKs simply don't enable
the HTTP admin server, while users on Java 17+ get a fully maintained Jetty.
This would also let the Jetty upgrade proceed independently of the broader Java
baseline discussion.
> Upgrade Jetty to address CVE-2026-2332
> --------------------------------------
>
> Key: ZOOKEEPER-5038
> URL: https://issues.apache.org/jira/browse/ZOOKEEPER-5038
> Project: ZooKeeper
> Issue Type: Task
> Components: server
> Affects Versions: 3.9.5, 3.8.6
> Reporter: Jota Martos
> Assignee: Dávid Paksy
> Priority: Major
>
> Jetty versions lower than 9.4.60 are affected by this CVE.
> bq. Jetty incorrectly parses quoted strings in HTTP/1.1 chunked transfer
> encoding extension values, enabling request smuggling attacks.
> You can find more information in the [security
> advisory|https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf].
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
