1216 matches found
CVE-2026-100302
Allocation of Resources Without Limits or Throttling in the multiRead request handler of Apache ZooKeeper allows a remote attacker to crash the server denial of service with a single small request. The multiRead handler places no limit on the number of bundled read operations or on the cumulative...
CVE-2026-100252
Improper Authorization vulnerability in Apache ZooKeeper. When SASL authentication is enabled on the client port, the server's SASL callback handler grants every authorization identity authzid that a client requests, without checking it against the principal the client authenticated as. The serve...
CVE-2026-100300
Improper handling of exceptional conditions in the quota subsystem of Apache ZooKeeper allows an attacker able to write under the /zookeeper/quota subtree — unauthenticated on default deployments, where that subtree is world-writable — to crash the server's critical request-processing thread and...
CVE-2026-100235
Incorrect authorization due to a time-of-check to time-of-use TOCTOU race condition in the setACL request handling of Apache ZooKeeper. When a node's ACL is changed via setACL, the pending change is not published to the server's outstanding change record for that node. Any request that is prepare...
CVE-2026-100302 Apache ZooKeeper: Denial of service through unbounded memory allocation in multiRead request handling
Allocation of Resources Without Limits or Throttling in the multiRead request handler of Apache ZooKeeper allows a remote attacker to crash the server denial of service with a single small request. The multiRead handler places no limit on the number of bundled read operations or on the cumulative...
CVE-2026-100302
Allocation of Resources Without Limits or Throttling in the multiRead request handler of Apache ZooKeeper allows a remote attacker to crash the server denial of service with a single small request. The multiRead handler places no limit on the number of bundled read operations or on the cumulative...
CVE-2026-115448 Apache ZooKeeper: Unbounded recursion in snapshot serialization allows a client to render the server unrecoverable
Uncontrolled recursion in Apache ZooKeeper. The server serializes its data tree to a snapshot by recursing one stack frame per znode level, with no depth bound. A client permitted to create znodes the default root ACL is open can build a chain of nested znodes deep enough that taking a snapshot...
EUVD-2026-116869
Uncontrolled recursion in Apache ZooKeeper. The server serializes its data tree to a snapshot by recursing one stack frame per znode level, with no depth bound. A client permitted to create znodes the default root ACL is open can build a chain of nested znodes deep enough that taking a snapshot...
CVE-2026-115448
Uncontrolled recursion in Apache ZooKeeper. The server serializes its data tree to a snapshot by recursing one stack frame per znode level, with no depth bound. A client permitted to create znodes the default root ACL is open can build a chain of nested znodes deep enough that taking a snapshot...
CVE-2026-100300 Apache ZooKeeper: Unauthenticated persistent denial of service via unvalidated quota-node data and paths crashing the transaction-apply thread
Improper handling of exceptional conditions in the quota subsystem of Apache ZooKeeper allows an attacker able to write under the /zookeeper/quota subtree — unauthenticated on default deployments, where that subtree is world-writable — to crash the server's critical request-processing thread and...
CVE-2026-100300
Apache ZooKeeper versions up to and including 3.9.6 are vulnerable to an unauthenticated persistent denial of service . The root cause is the improper handling of exceptional conditions in the quota subsystem (DataTree/StatsTrack/Quotas). An attacker can write unvalidated quota-node data and path...
CVE-2026-100252 Apache ZooKeeper: SASL authorization bypass on the client port through a client-supplied authorization ID
Improper Authorization vulnerability in Apache ZooKeeper. When SASL authentication is enabled on the client port, the server's SASL callback handler grants every authorization identity authzid that a client requests, without checking it against the principal the client authenticated as. The serve...
CVE-2026-100252
Improper Authorization vulnerability in Apache ZooKeeper. When SASL authentication is enabled on the client port, the server's SASL callback handler grants every authorization identity authzid that a client requests, without checking it against the principal the client authenticated as. The serve...
CVE-2026-100235
Incorrect authorization due to a time-of-check to time-of-use TOCTOU race condition in the setACL request handling of Apache ZooKeeper. When a node's ACL is changed via setACL, the pending change is not published to the server's outstanding change record for that node. Any request that is prepare...
CVE-2026-100235 Apache ZooKeeper: ACL enforcement bypass allows unauthorized operations to commit after an ACL revocation
Incorrect authorization due to a time-of-check to time-of-use TOCTOU race condition in the setACL request handling of Apache ZooKeeper. When a node's ACL is changed via setACL, the pending change is not published to the server's outstanding change record for that node. Any request that is prepare...
dubbo-CVE-2023-23638
CVE-2023-23638 For educational purposes only ZooKeeper required Tested on Java 8. Other versions have not been tested and are not guaranteed to work. To reproduce, add the VM parameter to DemoComsumer: -Ddubbo.hessian.allowNonSerializable=true. For details, see...
CLEANSTART-2026-TC39210 Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper s...
Security vulnerability affects the druid-fips package. Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS PTR when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for...
dubbo-rce
CVE-2023-23638 For learning and research purposes only. ZooKeeper is required. The test environment is Java 8. Other versions have not been tested and usability is not guaranteed. During reproduction, you need to add the VM parameter to DemoComsumer: -Ddubbo.hessian.allowNonSerializable=true. For...