Not rated
CVE-2017-5637 Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper…
Description
Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads to the server unable to serve legitimate client requests. Apache ZooKeeper thru version 3.4.9 and 3.5.2 suffer from this issue, fixed in 3.4.10, 3.5.3, and later.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache ZooKeeper | Versions not published |
References
- [dev] 20171009 [SECURITY] CVE-2017-5637: DOS attack on wchp/wchc four letter words (4lw) lists.apache.org
- 98814 www.securityfocus.com
- RHSA-2017:3355 access.redhat.com
- RHSA-2017:3354 access.redhat.com
- RHSA-2017:2477 access.redhat.com
- DSA-3871 www.debian.org
- [activemq-issues] 20190820 [jira] [Created] (AMQ-7279) Security Vulnerabilities in Libraries - jackson-databind-2.9.8.jar, tomcat-servlet-api-8.0.53.jar, tomcat-websocket-api-8.0.53.jar, zookeeper-3.4.6.jar, guava-18.0.jar, jetty-all-9.2.26.v20180806.jar, scala-library-2.11.0.jar lists.apache.org
- [nifi-commits] 20191113 svn commit: r1869773 - /nifi/site/trunk/security.html lists.apache.org
- [nifi-commits] 20200123 svn commit: r1873083 - /nifi/site/trunk/security.html lists.apache.org
- www.oracle.com www.oracle.com
- issues.apache.org issues.apache.org
- www.oracle.com www.oracle.com
Timeline
- Published
- Last modified
Other CVEs of Apache ZooKeeper
The 19 CVEs of Apache ZooKeeper →
CVE-2026-100302
Apache ZooKeeper: Denial of service through unbounded memory allocation in multiRead request handling
7.1
High
CVE-2026-115448
Apache ZooKeeper: Unbounded recursion in snapshot serialization allows a client to render the server unrecoverable
8.7
High
CVE-2026-100300
Apache ZooKeeper: Unauthenticated persistent denial of service via unvalidated quota-node data and paths crashing the transaction-apply thread
8.7
High
CVE-2026-100252
Apache ZooKeeper: SASL authorization bypass on the client port through a client-supplied authorization ID
8.6
High