Apache ZooKeeper CVE-2026-115448

Exploitation requires a client that is permitted to create znodes. By default this is unauthenticated and remote because ZooKeeper's root ACL is open (world-creatable), so default deployments are exploitable by any client that can reach the client port (2181). The concrete prerequisite is the ability to create a chain of nested znodes deep enough to overflow the JVM stack during snapshot serialization; individual records stay within jute.maxbuffer, so that limit does not prevent it. The primary limiting factor is the vendor-stated workaround: deployments that use ACLs and authentication to restrict znode creation remove the unauthenticated path, so an attacker would then need authorization to create znodes. Network reachability of the client port is also required, so clusters that firewall the client port to trusted clients reduce exposure. Updating to 3.8.8 or 3.9.7 (or 3.10.0) is the only complete fix per the vendor.

Signals point to a credible availability threat whose urgency is tempered by the lack of exploitation evidence. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) with VA:H describes a network-reachable, low-complexity, availability-only flaw requiring no authentication against a default deployment, which is consistent with the description: the default root ACL is open, so any client that can reach the client port can create znodes. However, the vuln.today Decision label is 'awaiting_data', and no EPSS score, no CISA KEV listing, and no public exploit were supplied - so there is no evidence of active or probable near-term exploitation to corroborate the high base score. The PR:N rating is honest only for default-open-ACL deployments; in environments that already enforce ACLs and authentication on znode creation the attacker must be authorized, effectively raising the privilege requirement. The severity driver is impact rather than likelihood: the DoS is persistent (the server rebuilds the deep tree from its transaction log and crashes again on the startup snapshot) and can propagate to followers across the ensemble via the shared log, so successful exploitation is hard to recover from and can entail data loss. Net: a genuinely serious availability/integrity-of-service issue worth prioritising for patching, but currently a high-CVSS issue without demonstrated exploitation rather than a confirmed emergency - the 'awaiting_data' label should be revisited if EPSS/KEV data later appears.

An attacker who can reach a ZooKeeper client port (2181) on a cluster using the default open root ACL creates a long chain of nested znodes, each a child of the last, staying under jute.maxbuffer per record. When the server next serializes its data tree to a snapshot, the one-stack-frame-per-level recursion exhausts the JVM stack and kills the snapshot thread; on restart the server rebuilds the deep tree from its transaction log and crashes again during the startup snapshot, and the same log can carry the condition to followers. No public exploit code was identified at time of analysis.