CVE-2026-115448

Uncontrolled recursion in Apache ZooKeeper. The server serializes its data tree to a snapshot by recursing one stack frame per znode level, with no depth bound. A client permitted to create znodes the default root ACL is open can build a chain of nested znodes deep enough that taking a snapshot...

Linux Distros Unpatched Vulnerability : CVE-2026-115448

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uncontrolled recursion in Apache ZooKeeper. The server serializes its data tree to a snapshot by recursing one stack frame per znode level, with no depth bound....

CVE-2026-115448

A flaw was found in Apache ZooKeeper. A remote attacker with permission to create data nodes znodes can build an excessively deep hierarchy of nested nodes, triggering uncontrolled recursion when the server saves a snapshot. This condition exhausts the call stack and terminates the snapshot...

DEBIAN-CVE-2026-115448

Uncontrolled recursion in Apache ZooKeeper. The server serializes its data tree to a snapshot by recursing one stack frame per znode level, with no depth bound. A client permitted to create znodes the default root ACL is open can build a chain of nested znodes deep enough that taking a snapshot...

CVE-2026-115448

Uncontrolled recursion in Apache ZooKeeper. The server serializes its data tree to a snapshot by recursing one stack frame per znode level, with no depth bound. A client permitted to create znodes the default root ACL is open can build a chain of nested znodes deep enough that taking a snapshot...

CVE-2026-115448 Apache ZooKeeper: Unbounded recursion in snapshot serialization allows a client to render the server unrecoverable

Uncontrolled recursion in Apache ZooKeeper. The server serializes its data tree to a snapshot by recursing one stack frame per znode level, with no depth bound. A client permitted to create znodes the default root ACL is open can build a chain of nested znodes deep enough that taking a snapshot...

EUVD-2026-116869

Uncontrolled recursion in Apache ZooKeeper. The server serializes its data tree to a snapshot by recursing one stack frame per znode level, with no depth bound. A client permitted to create znodes the default root ACL is open can build a chain of nested znodes deep enough that taking a snapshot...

CVE-2026-115448 Apache ZooKeeper: Unbounded recursion in snapshot serialization allows a client to render the server unrecoverable

Uncontrolled recursion in Apache ZooKeeper. The server serializes its data tree to a snapshot by recursing one stack frame per znode level, with no depth bound. A client permitted to create znodes the default root ACL is open can build a chain of nested znodes deep enough that taking a snapshot...

CVE-2026-115448

A vulnerability exists in Apache ZooKeeper (versions 3.8.0 through 3.8.7 and 3.9.0 through 3.9.6) due to uncontrolled recursion during snapshot serialization. The server recurses one stack frame per znode level without a depth bound, allowing a client with znode creation privileges—facilitated by...

PT-2026-136927

Uncontrolled recursion in Apache ZooKeeper. The server serializes its data tree to a snapshot by recursing one stack frame per znode level, with no depth bound. A client permitted to create znodes the default root ACL is open can build a chain of nested znodes deep enough that taking a snapshot...

CVE-2026-115448: Apache Software Foundation Apache ZooKeeper: Uncontrolled recursion in Apache ZooKeeper

Uncontrolled recursion in Apache ZooKeeper. The server serializes its data tree to a snapshot by recursing one stack frame per znode level, with no depth bound. A client permitted to create znodes the default root ACL is open can build a chain of nested znodes deep enough that taking a snapshot...

CLEANSTART-2026-OH00346 `deleteContainer` opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL re...

CVE-2026-79993 affects multiple packages. The deleteContainer opcode 0x14/20 is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent. See references for...

zookeeper: Apache ZooKeeper: Unauthorized znode deletion via missing ACL check

A flaw was found in Apache ZooKeeper. The deleteContainer opcode is processed without verifying Access Control List ACL permissions. A remote, unauthenticated attacker with network access to the ZooKeeper client port can delete any empty persistent znode, including container and TTL nodes. This c...

CLEANSTART-2026-GJ18736 `deleteContainer` opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL re...

CVE-2026-79993 affects multiple packages. The deleteContainer opcode 0x14/20 is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent. See references for...

CLEANSTART-2026-VL27493 `deleteContainer` opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL re...

Security vulnerability affects the spark package. The deleteContainer opcode 0x14/20 is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent...

PT-2026-108556

Security vulnerability affects the apache-hive package. The deleteContainer opcode 0x14/20 is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent...

BIT-ZOOKEEPER-2026-79993 Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znode

The deleteContainer opcode 0x14/20 is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent. This opcode is considered internal-only and the official clie...

Apache ZooKeeper 3.8.x < 3.8.7 / 3.9.x < 3.9.6 Multiple Vulnerabilities

The version of Apache ZooKeeper listening on the remote host is 3.8.x prior to 3.8.7 or 3.9.x prior to 3.9.6. It is, therefore, affected by multiple vulnerabilities: - Information disclosure via SetWatches reconnect replay due to a missing ACL check. An attacker can discover ACL-restricted paths ...

Linux Distros Unpatched Vulnerability : CVE-2026-79993

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The deleteContainer opcode 0x14/20 is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in t...

CVE-2026-79993

The deleteContainer opcode 0x14/20 is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent. This opcode is considered internal-only and the official clie...