Threats tagged 'ghsa-4ppq-6vhc-4q97'

Apache ZooKeeper versions 3.8.0 through 3.8.7 and 3.9.0 through 3.9.6 contain an uncontrolled recursion vulnerability during snapshot serialization. A client allowed to create znodes can create deeply nested znodes that exhaust the JVM stack when the server takes a snapshot, causing the snapshot thread to fail and resulting in a persistent denial of service. This failure recurs on server restart, potentially causing data loss and affecting the entire ensemble including leader and followers. Upgrading to versions 3.8.8 or 3.9.7 mitigates the issue. Restricting znode creation via ACLs and authentication is recommended as a workaround.