High [CVE-2026-115448] Uncontrolled recursion in Apache ZooKeeper
This high-severity Apache Software Foundation advisory covers CVE-2026-115448 affecting Apache ZooKeeper.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Get an email when Apache Software Foundation Data & Analytics (Spark/Hadoop/Gravitino) publishes the next one.
See Apache Software Foundation Data & Analytics (Spark/Hadoop/Gravitino)'s last 90 days of advisories first. Then choose the free weekly digest, or a free month of real-time alerts with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
Summary
Uncontrolled recursion in Apache ZooKeeper. The server serializes its data tree to a snapshot by recursing one stack frame per znode level, with no depth bound.
A client permitted to create znodes (the default root ACL is open) can build a chain of nested znodes deep enough that taking a snapshot exhausts the JVM stack and kills the snapshot thread; sizes stay within jute.maxbuffer, so existing limits do not prevent it.
This is a denial of service that becomes persistent: on restart the server rebuilds the deep tree from its transaction log and fails again while taking the startup snapshot, so it does not return to service, and recovery can entail data loss. The same log affects a leader and its followers, so it can spread across an ensemble.
This issue affects Apache ZooKeeper 3.8.0 through 3.8.7 and 3.9.0 through 3.9.6. Users are recommended to upgrade to 3.8.8 or 3.9.7, which fix the issue.
As a workaround, use ACLs and authentication to restrict znode creation rather than relying on the default open root ACL.
- through 3.8.7
- through 3.9.6
Official advisory · high-confidence parse· fetched 14 hours ago·verify at source
- 3.8.8
- 3.9.7
Official advisory · high-confidence parse· fetched 14 hours ago·verify at source
Mitigation checklist
- Users are recommended to upgrade to 3.8.8 or 3.9.7, which fix the issue.
- As a workaround, use ACLs and authentication to restrict znode creation rather than relying on the default open root ACL.
Official advisory · high-confidence parse· fetched 14 hours ago·verify at source
More Apache Software Foundation advisories
- CVE-2026-100302Nov 4, 2026Apache ZooKeeper denial of service
- CVE-2026-100300Nov 4, 2026Improper handling of exceptional conditions in the quota subsystem of Apache ZooKeeper
- CVE-2026-100252Nov 4, 2026Improper Authorization vulnerability in Apache ZooKeeper
- CVE-2026-100235Nov 4, 2026Apache ZooKeeper improper access control
- CVE-2026-84501Sep 16, 2026unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's
- CVE-2026-84439Sep 16, 2026When audit logging is enabled (zookeeper.audit.enable=true), an unauthenticated attacker
Android app · Google Play
Monitor future Apache Software Foundation CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.