Apache Accumulo 2.1.6 Security Bulletin: DoS Vulnerability Fix via Graceful Shutdown Authorization

Vulnerability Overview Apache Accumulo 2.1.6 addresses a security vulnerability that allows authenticated users without system privileges to send graceful shutdown requests to all Accumulo services. This action can lead to a Denial of Service (DoS) in the Accumulo cluster. Although the operation is logged as rejected, the server still executes the shutdown. Impact Scope Affected Versions: Apache Accumulo 2.1.4 and 2.1.5 Impact Description: Authenticated users without system privileges can issue graceful shutdown requests, causing a cluster denial of service. Remediation Fixed Version: Apache Accumulo 2.1.6 Remediation Measures: This version resolves the aforementioned security vulnerability, ensuring that authenticated users without system privileges cannot issue graceful shutdown requests. Other Notable Changes Performance Improvements: - The garbage collector has been modified to use server-side filters for candidate files, reducing memory usage. - Client-side code has been updated to avoid certain deadlock issues that could occur when users fail to close scanners. - Expected sizes for data structures are set at creation time to avoid performance losses associated with resizing. Upgrade Recommendation Upgrade Path: Users are advised to upgrade directly from version 2.1 to 2.1.6, rather than upgrading to any earlier 2.1 release. Related Links All changes since 2.1.5 All tickets related to this version View all releases Version Information Current Version: Apache Accumulo 2.1.6 Long Term Support Version: Yes Release Date: July 17, 2026 System Requirements Build Requirements: JDK 21 Runtime Requirements: Java 11 Upgrade Guide View Upgrade Guide Useful Links All changes since 2.1.5 All tickets related to this version View all releases Copyright Information Copyright: © 2011-2026 The Apache Software Foundation License: Apache License, Version 2.0 Trademark Information Trademarks: Apache®, the Apache project names, and the multicolored feather logo are registered trademarks or trademarks of the Apache Software Foundation in the United States and other countries. --- Summary: Apache Accumulo 2.1.6 fixes a critical security vulnerability that allows users without system privileges to issue graceful shutdown requests, leading to cluster denial of service. Users are recommended to upgrade to version 2.1.6 to resolve this issue.

Goal Reached Thanks to every supporter — we hit 100%!

Apache Accumulo 2.1.6 Security Bulletin: DoS Vulnerability Fix via Graceful Shutdown Authorization