CVE-2026-115448 Apache ZooKeeper: Unbounded recursion in snapshot serialization allows a client to render the server unrecoverable

Uncontrolled recursion in Apache ZooKeeper. The server serializes its data tree to a snapshot by recursing one stack frame per znode level, with no depth bound. A client permitted to create znodes the default root ACL is open can build a chain of nested znodes deep enough that taking a snapshot...

CVE-2026-115448

Uncontrolled recursion in Apache ZooKeeper. The server serializes its data tree to a snapshot by recursing one stack frame per znode level, with no depth bound. A client permitted to create znodes the default root ACL is open can build a chain of nested znodes deep enough that taking a snapshot...

CVE-2026-115448

A vulnerability exists in Apache ZooKeeper (versions 3.8.0 through 3.8.7 and 3.9.0 through 3.9.6) due to uncontrolled recursion during snapshot serialization. The server recurses one stack frame per znode level without a depth bound, allowing a client with znode creation privileges—facilitated by...