Buffer overflow in the C cli shell in Apache Zookeeper before 3.4.9 and 3.5.x before…
Priority MEDIUM 45CWE-119Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.
Summary
Buffer overflow in the C cli shell in Apache Zookeeper before 3.4.9 and 3.5.x before 3.5.3, when using the "cmd:" batch mode syntax, allows attackers to have unspecified impact via a long command string.
Why it matters now
EPSS 0.06793 94th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:zookeeper:*:*:*:*:*:*:*:* | up to 3.4.8 | Vulnerable | Apache |
| cpe:2.3:a:apache:zookeeper:3.5.0:*:*:*:*:*:*:* | 3.5.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:zookeeper:3.5.1:*:*:*:*:*:*:* | 3.5.1 | Vulnerable | Apache |
| cpe:2.3:a:apache:zookeeper:3.5.2:*:*:*:*:*:*:* | 3.5.2 | Vulnerable | Apache |
- cpe:2.3:a:apache:zookeeper:*:*:*:*:*:*:*:* Versions up to 3.4.8 Vulnerable ·Apache
- cpe:2.3:a:apache:zookeeper:3.5.0:*:*:*:*:*:*:* Versions 3.5.0 Vulnerable ·Apache
- cpe:2.3:a:apache:zookeeper:3.5.1:*:*:*:*:*:*:* Versions 3.5.1 Vulnerable ·Apache
- cpe:2.3:a:apache:zookeeper:3.5.2:*:*:*:*:*:*:* Versions 3.5.2 Vulnerable ·Apache
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
Not affected: 6 products
- Red Hat JBoss A-MQ 6
- Red Hat JBoss BRMS 6
- Red Hat JBoss Data Virtualization 6
- Red Hat JBoss Fuse 6
- Red Hat JBoss Fuse Service Works 6
- Red Hat OpenShift Enterprise 2
Timeline
- 2026-10-02 Threatist record created from CVE-2016-5017
- 2026-10-03 Alias added: GHSA-85r2-fvq8-6xw9
References
Advisory 2
Other 8
- [activemq-issues] 20190820 [jira] [Created] (AMQ-7279) Security Vulnerabilities in Libraries - jackson-databind-2.9.8.jar, tomcat-servlet-api-8.0.53.jar, tomcat-websocket-api-8.0.53.jar, zookeeper-3.4.6.jar, guava-18.0.jar, jetty-all-9.2.26.v20180806.jar, scala-library-2.11.0.jar
- [nifi-commits] 20191113 svn commit: r1869773 - /nifi/site/trunk/security.html
- [nifi-commits] 20200123 svn commit: r1873083 - /nifi/site/trunk/security.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html
- https://git-wip-us.apache.org/repos/asf?p=zookeeper.git%3Ba=commitdiff%3Bh=27ecf981a15554dc8e64a28630af7a5c9e2bdf4f
- https://git-wip-us.apache.org/repos/asf?p=zookeeper.git%3Ba=commitdiff%3Bh=f09154d6648eeb4ec5e1ac8a2bacbd2f8c87c14a
- [dubbo-notifications] 20211101 [GitHub] [dubbo] AlbumenJ opened a new issue #9177: Upgrade Zookeeper dependency
More Apache Zookeeper vulnerabilities
- TI-2017-03638 Missing authentication in Apache ZooKeeper CVSS 3.0HIGH 7.5
- TI-2023-24043 Apache ZooKeeper: Authorization bypass in SASL Quorum Peer Authentication CVSS 3.1CRITICAL 9.1
- TI-2021-04395 Possible request smuggling in HTTP/2 due missing validation CVSS 3.1MEDIUM 5.9
- TI-2024-34425 Apache ZooKeeper: Authentication bypass with IP-based authentication in Admin Server CVSS 3.1CRITICAL 9.1
- TI-2018-05789 Missing authorization in Apache ZooKeeper CVSS 3.1HIGH 7.5
- TI-2026-55327 Missing authorization in Apache ZooKeeper CVSS 3.1HIGH 7.5
Sources
- CVE-2016-5017 · CVE Program
- CVE-2016-5017 · NVD
- FIRST EPSS
- GHSA-85r2-fvq8-6xw9 · GitHub Advisory Database · CC BY 4.0
- CVE-2016-5017 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences