Bug 2566835 (CVE-2026-115448)

Summary:	CVE-2026-115448 org.apache.zookeeper/zookeeper: ZooKeeper: Denial of Service via deeply nested znodes during snapshot creation
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	asyoung, csuconic, dbruscin, gmalinko, gtully, janstey, jhollowa, jsherman, kvanderr, pdelbell, prichard, rgemmell, rgodfrey, rstepani, sthirugn, tbish, tlavocat
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Apache ZooKeeper. A remote attacker with permission to create data nodes (znodes) can build an excessively deep hierarchy of nested nodes, triggering uncontrolled recursion when the server saves a snapshot. This condition exhausts the call stack and terminates the snapshot process, resulting in a persistent Denial of Service (DoS). Because the server reprocesses the deep node structure from transaction logs upon reboot, the failure recurs across the ensemble and prevents the service from recovering.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-11-04 10:56:49 UTC

Uncontrolled recursion in Apache ZooKeeper. The server serializes its data tree to a snapshot by recursing one stack frame per znode level, with no depth bound. A client permitted to create znodes (the default root ACL is open) can build a chain of nested znodes deep enough that taking a snapshot exhausts the JVM stack and kills the snapshot thread; sizes stay within jute.maxbuffer, so existing limits do not prevent it. This is a denial of service that becomes persistent: on restart the server rebuilds the deep tree from its transaction log and fails again while taking the startup snapshot, so it does not return to service, and recovery can entail data loss. The same log affects a leader and its followers, so it can spread across an ensemble.

This issue affects Apache ZooKeeper 3.8.0 through 3.8.7 and 3.9.0 through 3.9.6. Users are recommended to upgrade to 3.8.8 or 3.9.7, which fix the issue. As a workaround, use ACLs and authentication to restrict znode creation rather than relying on the default open root ACL.