DEBIAN-CVE-2026-115448

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-115448
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-115448.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-115448
Upstream
  • CVE-2026-115448
Published
2026-11-04T11:17:14Z
Modified
2026-11-06T15:01:04Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
Summary
[none]
Details

Uncontrolled recursion in Apache ZooKeeper. The server serializes its data tree to a snapshot by recursing one stack frame per znode level, with no depth bound. A client permitted to create znodes (the default root ACL is open) can build a chain of nested znodes deep enough that taking a snapshot exhausts the JVM stack and kills the snapshot thread; sizes stay within jute.maxbuffer, so existing limits do not prevent it. This is a denial of service that becomes persistent: on restart the server rebuilds the deep tree from its transaction log and fails again while taking the startup snapshot, so it does not return to service, and recovery can entail data loss. The same log affects a leader and its followers, so it can spread across an ensemble. This issue affects Apache ZooKeeper 3.8.0 through 3.8.7 and 3.9.0 through 3.9.6. Users are recommended to upgrade to 3.8.8 or 3.9.7, which fix the issue. As a workaround, use ACLs and authentication to restrict znode creation rather than relying on the default open root ACL.

References

Affected packages

Debian:12 / zookeeper

Package

Name
zookeeper
Purl
pkg:deb/debian/zookeeper?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.8.0-11
3.8.0-11+deb12u1
3.8.0-11+deb12u2
3.9.1-1
3.9.2-1
3.9.2-2
3.9.3-1
3.9.3-2
3.9.4-1
3.9.4-2
3.9.5-1
3.9.5-2
3.9.6-1
3.9.6-2
3.9.6-3

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-115448.json"

Debian:13 / zookeeper

Package

Name
zookeeper
Purl
pkg:deb/debian/zookeeper?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.9.3-1
3.9.3-1+deb13u1
3.9.3-2
3.9.4-1
3.9.4-2
3.9.5-1
3.9.5-2
3.9.6-1
3.9.6-2
3.9.6-3

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-115448.json"

Debian:14 / zookeeper

Package

Name
zookeeper
Purl
pkg:deb/debian/zookeeper?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.9.3-1
3.9.3-2
3.9.4-1
3.9.4-2
3.9.5-1
3.9.5-2
3.9.6-1
3.9.6-2
3.9.6-3

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-115448.json"