Apache ZooKeeper vulnerable to unbounded recursion in snapshot serialization (CVE-2026-115448)
Original title: CVE-2026-115448: Apache ZooKeeper: Unbounded recursion in snapshot serialization allows a client to render the server unrecoverable
A client can cause the server to become unrecoverable by creating znodes due to no depth limit in recursion.
Apache ZooKeeper has an uncontrolled recursion in snapshot serialization. The server serializes data tree by recursing one stack frame per znode level without bound. A client with open ACL can exploit this to render the server unrecoverable. Affected versions include 3.9.0-3.9.7 and 3.8.0-3.8.8.
Unconfirmed: Fixed versions not specified in the report
- CVSS 8.7 (high)
- Default root ACL is open
- Uncontrolled recursion in snapshot
- No depth bound on znodes
Impact: client can render server unrecoverable
- 1.Upgrade to a patched version
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-115448 | — | — | — |
From the original article
Posted by Andor Molnar on Nov 03 Severity: CVSS 4. 0: 8. 7 (high) CVSS:4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.