Apache ZooKeeper vulnerable to unbounded recursion in snapshot serialization (CVE-2026-115448)
A client can cause the server to become unrecoverable by creating znodes due to no depth limit in recursion.
Stories per day · 30 days
6 stories, newest first · one card per story
Stories tagged #zookeeper
Apache ZooKeeper ACL enforcement bypass allows unauthorized operations
TOCTOU race condition in setACL request handling allows unauthorized operations to commit after an ACL revocation in versions 3.9.0 through 3.9.6 and 3.8.0 through 3.8.7.
CVE-2026-59969: Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode
CVE-2026-59969: Apache ZooKeeper quorum TLS skips peer hostname verification in FIPS-mode deployments, enabling potential server-to-server impersonation.
CVE-2026-59739: Apache ZooKeeper: Information disclosure via SetWatches reconnect replay
CVE-2026-59739: Apache ZooKeeper missing ACL check in SetWatches reconnect replay lets attackers discover ACL-restricted znode paths.
Re: CVE-2026-82434: Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs
Follow-up on oss-security asks why CVE-2026-82434, Apache Storm ZooKeeper credential disclosure to read-only users and logs, lacks a severity rating.
CVE-2026-82434: Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs
Apache Storm Nimbus and Client expose ZooKeeper topology credentials to read-only users and logs, fixed in 3.1.0.