# CVE-2026-115448

Deeply nested znodes cause persistent JVM stack-exhaustion DoS in Apache ZooKeeper

- Page: https://www.vulneraibility.com/cve/CVE-2026-115448
- CVSS: 8.7
- Known exploited: not in CISA KEV as of our last sync
- CISA SSVC: exploitation none, automatable yes, technical impact partial (assessed 2026-11-04)
- Weakness: CWE-770
- Published: 2026-11-04

## Affected versions

- Apache Software Foundation Apache ZooKeeper: affected >= 3.9.0 and <= 3.9.7; >= 3.8.0 and <= 3.8.8

A version outside these ranges is not a statement that it is unaffected.

## Impact

Attacker with znode-create permission can craft nested znodes to exhaust JVM stack during snapshots, causing persistent DoS across restarts, ensemble spread, and possible data loss.

## Action

Immediate action required

## Recommendation

Upgrade to 3.8.8 or 3.9.7; restrict znode creation via ACLs/authentication

## References

- [advisory] https://lists.apache.org/thread.html/p892jm8qw0zqv8z152lpokyt7mp6gc41
- [other] http://www.openwall.com/lists/oss-security/2026/11/03/13

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.