Description
Buffer overflow in the C cli shell in Apache Zookeeper before 3.4.9 and 3.5.x before 3.5.3, when using the "cmd:" batch mode syntax, allows attackers to have unspecified impact via a long command string.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | zookeeper | 3.4.9-1 | — |
| Debian 13 | zookeeper | 3.4.9-1 | — |
| Debian 12 | zookeeper | 3.4.9-1 | — |
| Debian 7 | zookeeper | 3.3.5+dfsg1-2+deb7u1 | DLA-630-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | zookeeper | 3.4.8-1ubuntu0.1~esm1 | USN-4789-1 |
| Ubuntu Pro 14.04 LTS | zookeeper | 3.4.5+dfsg-1ubuntu0.1~esm1 | USN-4789-1 |
Advisories 2
- USN-4789-1 zookeeper vulnerabilities Ubuntu Security Notices (USN) · Jun 29, 2026
- DLA-630-1 zookeeper - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- [oss-security] 20160916 [SECURITY] CVE-2016-5017: Buffer overflow vulnerability in ZooKeeper C cli shell mailing-list
- 93044 vdb-entry
- [activemq-issues] 20190820 [jira] [Created] (AMQ-7279) Security Vulnerabilities in Libraries - jackson-databind-2.9.8.jar, tomcat-servlet-api-8.0.53.jar, tomcat-websocket-api-8.0.53.jar, zookeeper-3.4.6.jar, guava-18.0.jar, jetty-all-9.2.26.v20180806 mailing-list
- [nifi-commits] 20191113 svn commit: r1869773 - /nifi/site/trunk/security.html mailing-list
- [nifi-commits] 20200123 svn commit: r1873083 - /nifi/site/trunk/security.html mailing-list
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html
- https://git-wip-us.apache.org/repos/asf?p=zookeeper.git%3Ba=commitdiff%3Bh=27ecf981a15554dc8e64a28630af7a5c9e2bdf4f
- https://zookeeper.apache.org/security.html#CVE-2016-5017
- http://packetstormsecurity.com/files/138755/ZooKeeper-3.4.8-3.5.2-Buffer-Overflow.html
- https://git-wip-us.apache.org/repos/asf?p=zookeeper.git%3Ba=commitdiff%3Bh=f09154d6648eeb4ec5e1ac8a2bacbd2f8c87c14a
- [dubbo-notifications] 20211101 [GitHub] [dubbo] AlbumenJ opened a new issue #9177: Upgrade Zookeeper dependency mailing-list