Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach ZooKeeper client port 2181
-
DeliveryWrite malformed data under /zookeeper/quota subtree
-
ExploitTrigger unhandled exception in quota subsystem
-
ExecutionCrash transaction-apply thread
-
ImpactCorrupt data directory, server permanently unbootable
Vulnerability Assessment
| Exploitation Conditions | Exploitation requires the ability to write (create/set data) under the /zookeeper/quota subtree. On default deployments that subtree is world-writable, so on the network-reachable client port (default 2181) the attack is unauthenticated (consistent with PR:N in the vendor CVSS 4.0 vector). The limiting factors are: (1) network exposure - ZooKeeper client ports are commonly restricted to internal/trusted networks, so internet-facing reachability is not the norm; and (2) ACL hardening - if operators have set non-default ACLs restricting the /zookeeper/quota subtree, write access requires authorization and the unauthenticated path is closed. Impact is a persistent denial of service: the data directory is left permanently unbootable, so recovery requires restore or rebuild rather than a restart. Only affected versions 3.8.0-3.8.7 and 3.9.0-3.9.6 are vulnerable; upgrading to 3.8.8 or 3.9.7 is stated by the vendor as the fix. |
| Impact | The vendor-assigned CVSS 4.0 score is 8.7 (high), driven entirely by a high availability impact (VA:H) with no confidentiality or integrity effect (VC:N/VI:N), over a network vector with low complexity and no privileges or user interaction (AV:N/AC:L/AT:N/PR:N/UI:N). What elevates this above a routine DoS is that the impact is persistent: the description states the attack renders the on-disk data directory 'permanently unbootable,' so recovery requires restore/rebuild rather than a simple restart. However, several key prioritization signals are missing or neutral: there is no EPSS probability supplied, the CVE is not listed in CISA KEV, and no public exploit is identified in the provided data. The vuln.today Decision label is 'awaiting_data,' which explicitly indicates insufficient signals for a firm priority call rather than an act_now/emergency posture. The PR:N rating is honest only for default deployments: the description conditions unauthenticated exploitation on the /zookeeper/quota subtree being world-writable, so the true exposure depends on whether ACLs and network reachability have been hardened. Net: this is a credible, potentially high-impact availability bug worth patching promptly, but real-world risk is bounded by whether a given ZooKeeper ensemble is network-exposed and left at default ACLs - classic for ZooKeeper, which is typically deployed on internal coordination networks. |
| Exploit ScenarioDerived | An attacker with network reachability to a ZooKeeper client port (default 2181) on a default-configured ensemble writes crafted node data and/or paths under the world-writable /zookeeper/quota subtree. The malformed quota data triggers improper handling of an exceptional condition in the quota subsystem, crashing the server's critical request-processing (transaction-apply) thread and corrupting the data directory so the server cannot be restarted. No public exploit code is identified in the available data; given AV:N/AC:L, exploitation would be low-effort against an exposed, unhardened deployment. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Persistent denial of service in Apache ZooKeeper 3.8.0 through 3.8.7 and 3.9.0 through 3.9.6 lets remote attackers crash the transaction-apply thread by writing crafted quota-node data under /zookeeper/quota, a subtree that is world-writable on default deployments and therefore reachable without authentication. The harm persists after restart because the on-disk data directory becomes permanently unbootable, so recovery requires restoring or rebuilding rather than simply restarting the service. Upgrading to 3.8.8 or 3.9.7 fixes the issue; no public exploit identified at time of analysis.
RemediationAI
Upgrade to Apache ZooKeeper 3.8.8 on the 3.8.x branch or 3.9.7 on the 3.9.x branch, which the vendor states fix the issue; see https://zookeeper.apache.org/ and https://seclists.org/oss-sec/2026/q4/486. If upgrading cannot be done immediately, restrict network access to the ZooKeeper client port, default 2181, to trusted hosts and set non-default ACLs that deny write access to /zookeeper/quota for untrusted clients; these controls close the unauthenticated path but do not remove the underlying validation defect, and the ACL change may require review of legitimate quota administration workflows. Because a successful attack leaves the data directory unbootable, recovery after exploitation requires restoring from backup or rebuilding the ensemble data rather than only restarting the service.
Affected ProductsAI
Apache ZooKeeper 3.8.0 through 3.8.7 and 3.9.0 through 3.9.6 are affected; the vendor description summarizes the issue as affecting ZooKeeper up to and including 3.9.6, with 3.8.8 and 3.9.7 as the fixed releases. No CPE strings were supplied in the available data. Vendor and advisory references include https://zookeeper.apache.org/ and the oss-security posting at https://seclists.org/oss-sec/2026/q4/486.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache ZooKeeper coordinates distributed systems through a hierarchical znode namespace and applies committed writes through a transaction-apply thread. The quota subsystem stores usage-related nodes under /zookeeper/quota, and the flaw is improper handling of exceptional conditions when quota-node data and paths are not validated, allowing crafted content to crash that critical request-processing thread. Because the malformed state is persisted in the transaction log and data directory, the server can be left unable to boot from disk. On default deployments the /zookeeper/quota subtree is world-writable, and a remote client that can reach the ZooKeeper client port, default 2181, can write the triggering znodes without authentication, consistent with PR:N in the vendor CVSS 4.0 vector; deployments with non-default ACLs restricting that subtree require authorization before the write path is reachable.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Default deployments expose a world-writable quota subtree over the network, so AV:N/AC:L/PR:N/UI:N; impact is persistent availability loss only, so A:H with C:N/I:N and unchanged scope.
Estimated by vuln.today — no official severity rating has been published for this CVE yet.
Description PRE-NVD
Executive ViewAI
Apache ZooKeeper versions 3.8.0-3.8.7 and 3.9.0-3.9.6 are vulnerable to a persistent denial-of-service attack that can permanently corrupt the data directory, preventing service restart and forcing a full rebuild or restore. Any organization relying on ZooKeeper for distributed coordination-such as Kafka, HBase, or cloud infrastructure-faces unplanned outages, data loss, and significant recovery costs. Leadership should prioritize immediate patching to protect service continuity and avoid operational disruption.
Apply vendor patch.
Threat Intelligence Overview
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
GitHub PoC
Exploit-DB