CVE-2016-5017: apache zookeeper
Vulnerability summary
CVE-2016-5017 is a high (CVSS 8.1) vulnerability in apache zookeeper. EPSS estimates a 6.79% chance of exploitation in the next 30 days, higher than 94% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (reference, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 21-09-2016PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Buffer overflow in the C cli shell in Apache Zookeeper before 3.4.9 and 3.5.x before 3.5.3, when using the "cmd:" batch mode syntax, allows attackers to have unspecified impact via a long command string.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated8.1HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.1HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
6.79%
Chance of exploitation in the next 30 days
Percentile
94%
Versus all other CVEs
30-day change
Decrease -1.06 pp
From 7.86% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (packetstormsecurity.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Apache1 product
- zookeeperEOL≤ 3.4.8 | 3.5.0 | 3.5.1 | 3.5.2
Debian1 product
- zookeeper< 3.4.9-1 | < 3.3.5+dfsg1-2+deb7u1
Mageia1 product
- zookeeper< 3.4.5-25.1.mga5
Ubuntu1 product
- zookeeper< 3.4.5+dfsg-1ubuntu0.1~esm1 | < 3.4.8-1ubuntu0.1~esm1
4 vendors · 4 products
References
19 links- www.openwall.com/lists/oss-security/2016/09/17/3Mailing ListX Refsource MLISTRelease NotesThird Party Advisory
- www.oracle.com/security-alerts/cpujul2020.htmlX Refsource MISC
- git-wip-us.apache.org/repos/…X Refsource CONFIRM
- packetstormsecurity.com/files/138755/ZooKeeper-3.4.8-3.5.2-Buffer-Overflow.htmlX Refsource MISCExploitThird Party AdvisoryVDB Entry
Show all 19 references
- git-wip-us.apache.org/repos/…X Refsource CONFIRM
