Uncontrolled Recursion Vulnerability in Apache ZooKeeper by Apache
CVE-2026-115448

8.7HIGH

Key Information:

Vendor

Apache
Status
Apache Zookeeper
Vendor
CVE Published:
4 November 2026

What is CVE-2026-115448?

The vulnerability in Apache ZooKeeper involves uncontrolled recursion, which can lead to a denial of service. When a client allowed to create znodes invokes this vulnerability, it can initiate a recursive process that exhausts the Java Virtual Machine (JVM) stack while the server attempts to serialize its data tree. This results in the exhausting of system resources, eventually crashing the snapshot thread. The persistence of the issue is critical; upon server restart, the deep tree is reconstructed from the transaction log, causing repeated failures during startup snapshots and preventing the service from returning to operational status. Recovery from this state may lead to data loss. To safeguard against this issue, it is advisable to implement access control lists (ACLs) and strict authentication measures for znode creation, rather than relying on the default configurations.

Affected Version(s)

Apache ZooKeeper 3.9.0 <= 3.9.7

Apache ZooKeeper 3.8.0 <= 3.8.8

References

https://lists.apache.org/thread.html/p892jm8qw0zqv8z152lp...
vendor-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sai Sreewathsa Kovalluri, Shon Babu, and Kannan K of Innspark Solutions (https://innspark.in/)
Prasath Jayasundar & PayPal Cyber Security Team
.