# CVE-2026-115448: Apache ZooKeeper uncontrolled recursion in snapshot serialization

Source: https://junglewise.ai/threats/cve-2026-115448-uncontrolled-recursion-in-apache-zookeeper-the-server-serializes  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-115448 · Severity: info · Published 2026-11-04

Apache ZooKeeper is a distributed coordination system used to manage configuration and state in cloud applications. An attacker who can create znodes (the basic data units in ZooKeeper, allowed by default) can craft a deeply nested structure that causes the server to run out of stack memory when taking snapshots, crashing the snapshot process and preventing the server from restarting—creating a persistent denial of service that can spread across an entire cluster.

Technologies: [Apache Zookeeper](https://junglewise.ai/threats/technologies/zookeeper). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-115448 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-115448 being exploited in the wild.

**How severe is CVE-2026-115448?** Informational severity, published 4 November 2026.

**Which products and versions are affected?** Apache Zookeeper 3.8.0 through 3.8.7, 3.9.0 through 3.9.6.

**Is there a fix for CVE-2026-115448?** Yes: fixed in ZooKeeper 3.8.8, 3.9.7. Until then: Restrict znode creation using ACLs and authentication rather than relying on the default open root ACL, which will prevent unauthorized clients from building malicious znode chains. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-115448 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-115448?** Check whether you run Apache Zookeeper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in ZooKeeper 3.8.8, 3.9.7

Restrict znode creation using ACLs and authentication rather than relying on the default open root ACL, which will prevent unauthorized clients from building malicious znode chains.

## Technical details

The vulnerability is an uncontrolled recursion in the snapshot serialization code that allocates one stack frame per znode level with no depth limit. An authenticated or default-access client can create a chain of nested znodes that exhausts the JVM stack during snapshot operations. Since the malicious transaction log persists, the attack survives server restarts and prevents the startup snapshot from completing, leaving the server unable to recover without potential data loss.

## Affected products

- Apache ZooKeeper 3.8.0 through 3.8.7, 3.9.0 through 3.9.6

## Timeline

- 2026-11-04: disclosed

## References

- [https://repo.maven.apache.org/maven2](https://repo.maven.apache.org/maven2)
- [https://lists.apache.org/thread.html/p892jm8qw0zqv8z152lpokyt7mp6gc41](https://lists.apache.org/thread.html/p892jm8qw0zqv8z152lpokyt7mp6gc41)

## Related threats

- [Apache ZooKeeper denial of service in multiRead handler](https://junglewise.ai/threats/cve-2026-100302-allocation-of-resources-without-limits-or-throttling-in-the)
- [Apache ZooKeeper quota subsystem denial of service](https://junglewise.ai/threats/cve-2026-100300-improper-handling-of-exceptional-conditions-in-the-quota)
- [Apache ZooKeeper improper authorization in SASL authentication](https://junglewise.ai/threats/cve-2026-100252-improper-authorization-vulnerability-in-apache-zookeeper-when)
- [Apache ZooKeeper setACL time-of-check time-of-use race condition](https://junglewise.ai/threats/cve-2026-100235-incorrect-authorization-due-to-a-time-of-check-to-time-of-use)
- [Apache ZooKeeper log injection via crafted add_auth request](https://junglewise.ai/threats/cve-2026-84501-apache-zookeeper-log-injection-via-crafted-add-auth-request)