AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

Apache ZooKeeperGHSA-7cwj-j333-x7f7

Uncontrolled Resource Consumption in Apache ZooKeeper

Apache ZooKeeper

CVE-2017-5637 · Published May 13, 2022 · updated Nov 8, 2023

High7.5
Fix: upgrade to 3.4.10 or later (2 fixed versions below)
GitHub advisory

Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads to the server unable to serve legitimate client requests. Apache ZooKeeper thru version 3.4.9 and 3.5.2 suffer from this issue, fixed in 3.4.10, 3.5.3, and later.

Affected versions

PackageAffectedFixed in
org.apache.zookeeper:zookeeper
Maven
>= 3.4.0, < 3.4.103.4.10
>= 3.5.0, < 3.5.33.5.3
Details and references
CVSS 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-400
Also known as
CVE-2017-5637

More Apache ZooKeeper advisories

All Apache ZooKeeper
Medium 4.3Sep 24, 2025Apache ZooKeeper: Insufficient Permission Check in AdminServer Snapshot/Restore CommandsCVE-2025-58457fixed in 3.9.4HighNov 7, 2024Apache ZooKeeper: Authentication bypass with IP-based authentication in Admin ServerCVE-2024-51504fixed in 3.9.3Medium 5.3Mar 15, 2024Apache ZooKeeper vulnerable to information disclosure in persistent watchers handlingCVE-2024-23944fixed in 3.8.4 +1Critical 9.1Oct 11, 2023Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeperCVE-2023-44981fixed in 3.7.2 +2High 7.5May 13, 2022Missing Authorization in Apache ZooKeeperCVE-2018-8012fixed in 3.4.10 +1Medium 5.9May 29, 2019Access control bypass in Apache ZooKeeperCVE-2019-0201fixed in 3.4.14 +1