{"id":"CVE-2026-115448","kind":"vulnerability","aliases":["CVE-2026-115448"],"related":[],"title":"Apache ZooKeeper: deep znode trees crash snapshots and block server restart","description":"Uncontrolled recursion in Apache ZooKeeper. The server serializes its data tree to a snapshot by recursing one stack frame per znode level, with no depth bound. A client permitted to create znodes (the default root ACL is open) can build a chain of nested znodes deep enough that taking a snapshot exhausts the JVM stack and kills the snapshot thread; sizes stay within jute.maxbuffer, so existing limits do not prevent it. This is a denial of service that becomes persistent: on restart the server rebuilds the deep tree from its transaction log and fails again while taking the startup snapshot, so it does not return to service, and recovery can entail data loss. The same log affects a leader and its followers, so it can spread across an ensemble.\n\nThis issue affects Apache ZooKeeper 3.8.0 through 3.8.7 and 3.9.0 through 3.9.6. Users are recommended to upgrade to 3.8.8 or 3.9.7, which fix the issue. As a workaround, use ACLs and authentication to restrict znode creation rather than relying on the default open root ACL.","summary":"ZooKeeper's snapshot code recurses once per znode level with no depth limit, so a client that can create nested znodes can build a tree that exhausts the JVM stack. The same tree is rebuilt from the transaction log on restart, so the server keeps failing and can lose data during recovery.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hadoop","hbase","kafka","package","self-hosted","zookeeper"],"not_affected_if":["auth-required","patched-version","restricted-root-acl"],"how_to_check":"- Check the ZooKeeper version with `zkServer.sh version` and compare it to the affected ranges 3.8.0 through 3.8.7 and 3.9.0 through 3.9.6.\n- Check whether the root ACL still allows open znode creation (the default), for example with `zkCli.sh getAcl /`.\n- Identify which clients can create znodes and whether authentication is required.","fix":"- Apache ZooKeeper `3.8.8` for the 3.8 line\n- Apache ZooKeeper `3.9.7` for the 3.9 line\n- Workaround stated by the source: restrict znode creation with ACLs and authentication instead of the default open root ACL","status":"open","published_at":"2026-11-04T11:17:14+00:00","first_seen_at":"2026-11-04T11:26:45+00:00","triaged_at":"2026-11-04T11:27:33+00:00","updated_at":"2026-11-04T11:27:33+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-04T11:27:33Z","model":"claude-haiku-5-5","output":{"fix":"- Apache ZooKeeper `3.8.8` for the 3.8 line\n- Apache ZooKeeper `3.9.7` for the 3.9 line\n- Workaround stated by the source: restrict znode creation with ACLs and authentication instead of the default open root ACL","reach":"network","title":"Apache ZooKeeper: deep znode trees crash snapshots and block server restart","impact":"medium","summary":"ZooKeeper's snapshot code recurses once per znode level with no depth limit, so a client that can create nested znodes can build a tree that exhausts the JVM stack. The same tree is rebuilt from the transaction log on restart, so the server keeps failing and can lose data during recovery.","audience":"businesses","category":"package","nicknames":[],"who_cares":["zookeeper","kafka","hadoop","hbase","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Ensemble stops serving after restart and data may be lost during recovery","analyst_note":"","how_to_check":"- Check the ZooKeeper version with `zkServer.sh version` and compare it to the affected ranges 3.8.0 through 3.8.7 and 3.9.0 through 3.9.6.\n- Check whether the root ACL still allows open znode creation (the default), for example with `zkCli.sh getAcl /`.\n- Identify which clients can create znodes and whether authentication is required.","plain_action":"","needs_analyst":false,"not_affected_if":["patched-version","auth-required","restricted-root-acl"],"who_is_affected":"Any deployment running ZooKeeper 3.8.0 through 3.8.7 or 3.9.0 through 3.9.6 where clients can create znodes, which is the default because the root ACL is open. Ensembles are affected together because the leader and followers replay the same log. Deployments that already restrict znode creation with ACLs and authentication are less exposed.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.00079,"input_tokens":4371,"output_tokens":705,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-115448':14A,17A '-2026':13A,16A '3.8.0':212C '3.8.7':214C '3.8.8':225C '3.9.0':216C '3.9.6':218C '3.9.7':227C 'acl':113C,236C,251C 'across':204C 'affect':194C,209C 'apach':1A,81C,210C 'authent':238C 'becom':156C 'block':9A 'bound':103C 'build':48B,117C 'chain':119C 'client':41B,105C 'code':29B 'crash':6A 'creat':44B,108C 'creation':242C 'cve':12A,15A 'data':75B,87C,189C 'deep':3A,123C,164C 'default':111C,248C 'denial':152C 'depth':37B,102C 'enough':124C 'ensembl':206C 'entail':188C 'exhaust':52B,129C 'exist':143C 'fail':71B,171C 'fix':229C 'follow':199C 'frame':96C 'hadoop':18B 'hbase':19B 'host':24B 'issu':208C,231C 'jute.maxbuffer':141C 'jvm':54B,131C 'kafka':20B 'keep':70B 'kill':134C 'leader':196C 'level':34B,99C 'limit':38B,144C 'log':64B,169C,193C 'lose':74B 'loss':190C 'nest':45B,121C 'one':94C 'open':115C,249C 'packag':21B 'per':32B,97C 'permit':106C 'persist':157C 'prevent':147C 'rather':243C 'rebuild':162C 'rebuilt':60B 'recommend':221C 'recoveri':77B,186C 'recurs':30B,79C,93C 'reli':245C 'restart':11A,66B,159C 'restrict':240C 'return':182C 'root':112C,250C 'self':23B 'self-host':22B 'serial':85C 'server':10A,69B,84C,161C 'servic':154C,184C 'size':138C 'snapshot':7A,28B,91C,128C,136C,177C 'spread':203C 'stack':55B,95C,132C 'startup':176C 'stay':139C 'take':126C,174C 'thread':137C 'transact':63B,168C 'tree':5A,50B,58B,88C,165C 'uncontrol':78C 'upgrad':223C 'use':235C 'user':219C 'within':140C 'workaround':234C 'znode':4A,33B,46B,98C,109C,122C,241C 'zookeep':2A,25B,26B,82C,211C","nicknames":[],"mitigations":[],"who_affected":"Any deployment running ZooKeeper 3.8.0 through 3.8.7 or 3.9.0 through 3.9.6 where clients can create znodes, which is the default because the root ACL is open. Ensembles are affected together because the leader and followers replay the same log. Deployments that already restrict znode creation with ACLs and authentication are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["hadoop","hbase","high","kafka","package","selfhosted","zookeeper"],"campaign_type":null,"first_public_at":"2026-11-04T11:17:14+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115448","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115448","severity":null,"published_at":"2026-11-04T11:17:14+00:00","modified_at":"2026-11-04T11:17:14+00:00","first_seen_at":"2026-11-04T11:26:45+00:00","fetched_at":"2026-11-04T11:26:45+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}