CVE-2026-115448

Ranges per package from the CVE rows that match this port, in pkg notation with the port's epoch and revision, every bound checked with pkg; one range per epoch the port actually had. make newentry in security/vuxml creates the vid.

Copy to clipboard

  <vuln vid="FIXME (make newentry)">
    <topic>libzookeeper -- FIXME</topic>
    <affects>
      <package>
	<name>libzookeeper</name>
	<name>zookeeper</name>
	<range><ge>3.8.0</ge><le>3.8.8</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>CVE-2026-115448: Uncontrolled recursion in Apache ZooKeeper. The
	  server serializes its data tree to a snapshot by recursing one
	  stack frame per znode level, with no depth bound. A client
	  permitted to create znodes (the default root ACL is open) can build
	  a chain of nested znodes deep enough that taking a snapshot
	  exhausts the JVM stack and kills the snapshot thread; sizes stay
	  within jute.maxbuffer, so existing limits do not prevent it. This
	  is a denial of service that becomes persistent: on restart the
	  server rebuilds the deep tree from its transaction log and fails
	  again while taking the startup snapshot, so it does not return to
	  service, and recovery can entail data loss. The same log affects a
	  leader and its followers, so it can spread across an ensemble. This
	  issue affects Apache ZooKeeper 3.8.0 through 3.8.7 and 3.9.0
	  through 3.9.6. Users are recommended to upgrade to 3.8.8 or 3.9.7,
	  which fix the issue. As a workaround, use ACLs and authentication
	  to restrict znode creation rather than relying on the default open
	  root ACL.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-115448</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-115448</url>
    </references>
    <dates>
      <discovery>2026-11-04</discovery>
      <entry>2026-11-04</entry>
    </dates>
  </vuln>