CVE-2026-115448
Description
A flaw was found in Apache ZooKeeper. A remote attacker with permission to create data nodes (znodes) can build an excessively deep hierarchy of nested nodes, triggering uncontrolled recursion when the server saves a snapshot. This condition exhausts the call stack and terminates the snapshot process, resulting in a persistent Denial of Service (DoS). Because the server reprocesses the deep node structure from transaction logs upon reboot, the failure recurs across the ensemble and prevents the service from recovering.
Statement
Red Hat rates this flaw with an Important severity because an untrusted network client with write permissions can induce an unrecoverable denial of service across an entire cluster, persisting across daemon restarts. In typical Red Hat deployments, ZooKeeper instances are maintained within isolated internal networks, which restricts direct reachability from untrusted endpoints. However, if default permissive access permissions on root paths are preserved, any permitted client can construct deeply nested node hierarchies that exhaust the call stack during state serialization, causing cluster-wide failure and impeding recovery.
Mitigation
Restrict network exposure and enforce strict authentication and Access Control Lists (ACLs) on ZooKeeper instances:
1. Network Isolation:
Limit access to ZooKeeper service ports (such as TCP port 2181) strictly to trusted application infrastructure using firewalld:
firewall-cmd --zone=trusted --add-source=<trusted-client-ip> --permanent
firewall-cmd --permanent --remove-port=2181/tcp
firewall-cmd --reload
2. Access Control Configuration:
Configure authentication (such as SASL or digest) and replace the default open root ACL to revoke unauthenticated creation rights on the root path using the administrative client:
setAcl / auth:<user>:<password>:cdwra
Caveats: Applying strict ACLs and restricting network ports will block clients that rely on anonymous or unauthenticated connections until valid credentials are provided.
Warning: Reloading firewall rules or modifying ZooKeeper configuration parameters may cause transient service interruptions or require restarting dependent cluster components.
--- CME Mitigation Guidance (2026-11-04) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to enforce depth limits or eliminate unbounded recursion during data tree snapshot serialization in ZooKeeper: upgrade to Apache ZooKeeper 3.8.8 or 3.9.7 (or the corresponding fixed Red Hat builds), which bounds recursion depth during data tree snapshot serialization to prevent JVM stack exhaustion, closing creation of deeply nested znode hierarchies. Until patched, this is a concern on ZooKeeper instances with network-exposed service ports permitting znode creation, so Restrict network access to ZooKeeper service ports to trusted systems and enforce authentication to revoke default open root ACL creation permissions. These controls limit blast radius and contain exploitation, but they do not fix the underlying uncontrolled recursion defect — apply the upstream patch to fully remediate.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
