CVE-2026-115448

Uncontrolled recursion in Apache ZooKeeper. The server serializes its data tree to a snapshot by recursing one stack frame per znode level, with no depth bound. A client permitted to create znodes (the default root ACL is open) can build a chain of nested znodes deep enough that taking a snapshot exhausts the JVM stack and kills the snapshot thread; sizes stay within jute.maxbuffer, so existing limits do not prevent it. This is a denial of service that becomes persistent: on restart the server rebuilds the deep tree from its transaction log and fails again while taking the startup snapshot, so it does not return to service, and recovery can entail data loss. The same log affects a leader and its followers, so it can spread across an ensemble. This issue affects Apache ZooKeeper 3.8.0 through 3.8.7 and 3.9.0 through 3.9.6. Users are recommended to upgrade to 3.8.8 or 3.9.7, which fix the issue. As a workaround, use ACLs and authentication to restrict znode creation rather than relying on the default open root ACL.

• CWE-770

• https://lists.apache.org/thread.html/p892jm8qw0zqv8z152lpokyt7mp6gc41
• https://www.openwall.com/lists/oss-security/2026/11/03/13

Published

Nov 4, 2026

Last Modified

Nov 4, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-115417Memory allocation with excessive size value in the MQTT 3.1.…7.5
• CVE-2026-115418SQL injection in the database-query custom resource handlers…7.3
• CVE-2026-115419The A2A server component in Amazon Strands Agents SDK for Py…8.1
• CVE-2026-115424A flaw was found in the OpenShift client oc. When extracting…5.5
• CVE-2026-115425Multiple cross site scripting (XSS) vulnerabilities affect O…5.6
• CVE-2026-115426The WPvivid — Backup, Migration & Staging WordPress plugin b…5.5
• CVE-2026-115449A flaw was found in libslirp. When handling ICMP echo reques…3.5
• CVE-2026-11545IBM WebSphere Application Server 8.5 and 9.0 could allow a r…3.7
• CVE-2026-115450External Control of Assumed-Immutable Web Parameter (CWE-472…7.1
• CVE-2026-115451Joomla Extension - tassos.gr - File deletion through imprope…6.5
• CVE-2026-115452Joomla Extension - tassos.gr - Privileged stored XSS in Adva…6.7
• CVE-2026-115453Authorization Bypass Through User-Controlled Key (CWE-639) i…7.1