Quick answers
- Is CVE-2026-115448 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-115448 being exploited in the wild.
- How severe is CVE-2026-115448?
- Informational severity, published 4 November 2026.
- Which products and versions are affected?
- Apache Zookeeper 3.8.0 through 3.8.7, 3.9.0 through 3.9.6.
- Is there a fix for CVE-2026-115448?
- Yes: fixed in ZooKeeper 3.8.8, 3.9.7. Until then: Restrict znode creation using ACLs and authentication rather than relying on the default open root ACL, which will prevent unauthorized clients from building malicious znode chains. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-115448 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-115448?
- Check whether you run Apache Zookeeper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: ZooKeeper 3.8.8, 3.9.7
Restrict znode creation using ACLs and authentication rather than relying on the default open root ACL, which will prevent unauthorized clients from building malicious znode chains.
Technical details
The vulnerability is an uncontrolled recursion in the snapshot serialization code that allocates one stack frame per znode level with no depth limit. An authenticated or default-access client can create a chain of nested znodes that exhausts the JVM stack during snapshot operations. Since the malicious transaction log persists, the attack survives server restarts and prevents the startup snapshot from completing, leaving the server unable to recover without potential data loss.
Affected products
- Apache ZooKeeper 3.8.0 through 3.8.7, 3.9.0 through 3.9.6
Timeline
- 2026-11-04: disclosed