Missing authentication in Apache ZooKeeper
Priority HIGH 71CWE-306Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass, Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 3 fixed, 3 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-306 and CWE-400.
Summary
Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads to the server unable to serve legitimate client requests. Apache ZooKeeper thru version 3.4.9 and 3.5.2 suffer from this issue, fixed in 3.4.10, 3.5.3, and later.
Why it matters now
EPSS 0.73064 99th percentileScored 2026-11-07
Fix Partial org.apache.zookeeper:zookeeper (Maven): 3.4.10, 3.5.3Red Hat: 3 advisoriesRed Hat: 3 fixed, 3 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache ZooKeeper | 3.4.0 to 3.4.9; 3.5.0 to 3.5.2 | — | No fix listed | CNA |
| — | org.apache.zookeeper:zookeeper (Maven) | 3.4.0 to before 3.4.10 | 3.4.10 | Patch available | GHSA-7cwj-j333-x7f7 |
| — | org.apache.zookeeper:zookeeper (Maven) | 3.5.0 to before 3.5.3 | 3.5.3 | Patch available | GHSA-7cwj-j333-x7f7 |
- Apache ZooKeeper VendorApache Affected 3.4.0 to 3.4.9; 3.5.0 to 3.5.2 Fixed in — No fix listed CNA
- org.apache.zookeeper:zookeeper (Maven) Vendor— Affected 3.4.0 to before 3.4.10 Fixed in 3.4.10 Patch available GHSA-7cwj-j333-x7f7
- org.apache.zookeeper:zookeeper (Maven) Vendor— Affected 3.5.0 to before 3.5.3 Fixed in 3.5.3 Patch available GHSA-7cwj-j333-x7f7
CPE configurations NVD · 14
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:zookeeper:3.4.0:*:*:*:*:*:*:* | 3.4.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:zookeeper:3.4.1:*:*:*:*:*:*:* | 3.4.1 | Vulnerable | Apache |
| cpe:2.3:a:apache:zookeeper:3.4.2:*:*:*:*:*:*:* | 3.4.2 | Vulnerable | Apache |
| cpe:2.3:a:apache:zookeeper:3.4.3:*:*:*:*:*:*:* | 3.4.3 | Vulnerable | Apache |
| cpe:2.3:a:apache:zookeeper:3.4.4:*:*:*:*:*:*:* | 3.4.4 | Vulnerable | Apache |
| cpe:2.3:a:apache:zookeeper:3.4.5:*:*:*:*:*:*:* | 3.4.5 | Vulnerable | Apache |
| cpe:2.3:a:apache:zookeeper:3.4.6:*:*:*:*:*:*:* | 3.4.6 | Vulnerable | Apache |
| cpe:2.3:a:apache:zookeeper:3.4.7:*:*:*:*:*:*:* | 3.4.7 | Vulnerable | Apache |
| cpe:2.3:a:apache:zookeeper:3.4.8:*:*:*:*:*:*:* | 3.4.8 | Vulnerable | Apache |
| cpe:2.3:a:apache:zookeeper:3.4.9:*:*:*:*:*:*:* | 3.4.9 | Vulnerable | Apache |
- cpe:2.3:a:apache:zookeeper:3.4.0:*:*:*:*:*:*:* Versions 3.4.0 Vulnerable ·Apache
- cpe:2.3:a:apache:zookeeper:3.4.1:*:*:*:*:*:*:* Versions 3.4.1 Vulnerable ·Apache
- cpe:2.3:a:apache:zookeeper:3.4.2:*:*:*:*:*:*:* Versions 3.4.2 Vulnerable ·Apache
- cpe:2.3:a:apache:zookeeper:3.4.3:*:*:*:*:*:*:* Versions 3.4.3 Vulnerable ·Apache
- cpe:2.3:a:apache:zookeeper:3.4.4:*:*:*:*:*:*:* Versions 3.4.4 Vulnerable ·Apache
- cpe:2.3:a:apache:zookeeper:3.4.5:*:*:*:*:*:*:* Versions 3.4.5 Vulnerable ·Apache
- cpe:2.3:a:apache:zookeeper:3.4.6:*:*:*:*:*:*:* Versions 3.4.6 Vulnerable ·Apache
- cpe:2.3:a:apache:zookeeper:3.4.7:*:*:*:*:*:*:* Versions 3.4.7 Vulnerable ·Apache
- cpe:2.3:a:apache:zookeeper:3.4.8:*:*:*:*:*:*:* Versions 3.4.8 Vulnerable ·Apache
- cpe:2.3:a:apache:zookeeper:3.4.9:*:*:*:*:*:*:* Versions 3.4.9 Vulnerable ·Apache
Show 4 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:zookeeper:3.5.0:*:*:*:*:*:*:* | 3.5.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:zookeeper:3.5.1:*:*:*:*:*:*:* | 3.5.1 | Vulnerable | Apache |
| cpe:2.3:a:apache:zookeeper:3.5.2:*:*:*:*:*:*:* | 3.5.2 | Vulnerable | Apache |
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Debian |
- cpe:2.3:a:apache:zookeeper:3.5.0:*:*:*:*:*:*:* Versions 3.5.0 Vulnerable ·Apache
- cpe:2.3:a:apache:zookeeper:3.5.1:*:*:*:*:*:*:* Versions 3.5.1 Vulnerable ·Apache
- cpe:2.3:a:apache:zookeeper:3.5.2:*:*:*:*:*:*:* Versions 3.5.2 Vulnerable ·Apache
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
Remediation
- Fix · GHSA-7cwj-j333-x7f7 org.apache.zookeeper:zookeeper (Maven) Fixed in 3.4.10 Advisory →
- Fix · GHSA-7cwj-j333-x7f7 org.apache.zookeeper:zookeeper (Maven) Fixed in 3.5.3 Advisory →
Red Hat 3 advisories
- RHSA-2017:3354 Released 2017-11-30 · Red Hat rating ModerateRed Hat JBoss BRMS 6.4.7 security update
- Red Hat JBoss BRMS 6.4
- RHSA-2017:3355 Released 2017-11-30 · Red Hat rating ModerateRed Hat JBoss BPM Suite 6.4.7 security update
- Red Hat JBoss BPMS 6.4
- RHSA-2017:2477 Released 2017-08-15 · Red Hat rating ImportantRed Hat JBoss Data Virtualization 6.3 Update 7 security update
- Red Hat JBoss Data Virtualization 6.3
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss A-MQ 6 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Enterprise 2 | Affected | — |
| Red Hat JBoss BPMS 6.4 | Fixed | RHSA-2017:3355 |
| Red Hat JBoss BRMS 6.4 | Fixed | RHSA-2017:3354 |
| Red Hat JBoss Data Virtualization 6.3 | Fixed | RHSA-2017:2477 |
Timeline
- 2026-10-02 Threatist record created from CVE-2017-5637
- 2026-10-03 Alias added: GHSA-7cwj-j333-x7f7
References
Advisory 6
Other 10
- [dev] 20171009 [SECURITY] CVE-2017-5637: DOS attack on wchp/wchc four letter words (4lw)
- [activemq-issues] 20190820 [jira] [Created] (AMQ-7279) Security Vulnerabilities in Libraries - jackson-databind-2.9.8.jar, tomcat-servlet-api-8.0.53.jar, tomcat-websocket-api-8.0.53.jar, zookeeper-3.4.6.jar, guava-18.0.jar, jetty-all-9.2.26.v20180806.jar, scala-library-2.11.0.jar
- [nifi-commits] 20191113 svn commit: r1869773 - /nifi/site/trunk/security.html
- [nifi-commits] 20200123 svn commit: r1873083 - /nifi/site/trunk/security.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272@%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/58170aeb7a681d462b7fa31cae81110cbb749d2dc83c5736a0bb8370@%3Cdev.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3@%3Ccommits.nifi.apache.org%3E
- https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E
More Apache Zookeeper vulnerabilities
- TI-2023-24043 Apache ZooKeeper: Authorization bypass in SASL Quorum Peer Authentication CVSS 3.1CRITICAL 9.1
- TI-2021-04395 Possible request smuggling in HTTP/2 due missing validation CVSS 3.1MEDIUM 5.9
- TI-2024-34425 Apache ZooKeeper: Authentication bypass with IP-based authentication in Admin Server CVSS 3.1CRITICAL 9.1
- TI-2016-04336 Buffer overflow in the C cli shell in Apache Zookeeper before 3.4.9 and 3.5.x before… CVSS 3.0HIGH 8.1
- TI-2018-05789 Missing authorization in Apache ZooKeeper CVSS 3.1HIGH 7.5
- TI-2026-55327 Missing authorization in Apache ZooKeeper CVSS 3.1HIGH 7.5
Sources
- CVE-2017-5637 · CVE Program
- CVE-2017-5637 · NVD
- FIRST EPSS
- GHSA-7cwj-j333-x7f7 · GitHub Advisory Database · CC BY 4.0
- CVE-2017-5637 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences