Cyber ·
CVE-2026-115448: unbounded recursion in ZooKeeper snapshots can leave the server unrecoverable
Public alert on Apache ZooKeeper: a client allowed to create znodes can trigger excessive recursion during snapshot serialization and leave the server unrecoverable. CVSS 4.0 score 8.7 (high).
According to the advisory published by Andor Molnar on 3 November 2026 and relayed through the oss-sec list feed, vulnerability CVE-2026-115448 affects Apache ZooKeeper versions 3.9.0 through 3.9.7 and 3.8.0 through 3.8.8. The problem lies in snapshot serialization: the server walks the data tree recursively, using one stack frame per znode level, with no depth limit. A client allowed to create znodes, which is the default because the root ACL is open, can trigger excessive recursion and leave the server unrecoverable. The CVSS 4.0 score is 8.7 (high), with a network vector, low complexity, no privileges required under the metric, no user interaction, and high impact on availability only. This text is an automatic translation of a relay, so check the original advisory on the oss-sec list and the Apache project's fix notes before acting. For operators of ZooKeeper, the practical steps are to verify the installed version, apply the fixed release indicated by the project, and restrict who can create znodes.