// What runs on ZooKeeper / storm
Does Apache Storm use ZooKeeper?
RequiredYes. The Storm cluster setup guide makes a ZooKeeper cluster step one: Nimbus, the supervisors and the workers coordinate through it, and storm.zookeeper.servers is mandatory configuration. That is still true of Storm 3.1.0, released in September 2026. Storm does not pass messages through ZooKeeper, so the load it places on the ensemble is low, but cluster state and leadership depend on it.
Trusted globally by enterprises
What Apache Storm uses ZooKeeper for
- Nimbus leader election when several Nimbus hosts run for high availability.
- Supervisor registration and topology assignments.
- Worker heartbeats, backpressure and error state, unless heartbeats are moved to Pacemaker.
- The list of active topologies, and blobstore state when Nimbus HA uses the local file system blobstore.
Which ZooKeeper version ships with Apache Storm
From the zookeeper.version property in pom.xml at each release tag. Storm 2.x and 3.x shade the ZooKeeper client into lib/storm-shaded-deps-<version>.jar under org.apache.storm.shade, so there is no zookeeper jar in lib/ and scanners may report it under the Storm artifact. storm dev-zookeeper starts a ZooKeeper server from that bundled copy, for development and testing only.
| Release | ZooKeeper | ZooKeeper line status | Open ZooKeeper CVEs |
|---|---|---|---|
| Storm 1.2.4 and 2.0.0 to 2.3.1 | 3.4.14 | End of life since 1 June 2020Bundles log4j 1.2.17 | 1 (CVE-2023-44981)2026 advisories not assessed for this line |
| Storm 2.4.0 and 2.5.0 | 3.5.9 | End of life since 1 June 2022Bundles log4j 1.2.17 | 1 (CVE-2023-44981)2026 advisories not assessed for this line |
| Storm 2.6.0 and 2.6.1 | 3.9.1 | Supported (latest 3.9.6) | 8 (CVE-2024-23944, CVE-2024-51504, CVE-2025-58457, CVE-2026-24281, CVE-2026-24308, CVE-2026-59739, CVE-2026-59969, CVE-2026-79993) |
| Storm 2.6.2 to 2.7.0 | 3.9.2 | Supported (latest 3.9.6) | 7 (CVE-2024-51504, CVE-2025-58457, CVE-2026-24281, CVE-2026-24308, CVE-2026-59739, CVE-2026-59969, CVE-2026-79993) |
| Storm 2.7.1 to 2.8.2 | 3.9.3 | Supported (latest 3.9.6) | 6 (CVE-2025-58457, CVE-2026-24281, CVE-2026-24308, CVE-2026-59739, CVE-2026-59969, CVE-2026-79993) |
| Storm 2.8.3 and 2.8.4 | 3.9.4 | Supported (latest 3.9.6) | 5 (CVE-2026-24281, CVE-2026-24308, CVE-2026-59739, CVE-2026-59969, CVE-2026-79993) |
| Storm 2.8.5 to 2.8.9, 3.0.0 and 3.1.02.8.9 is the final 2.x release | 3.9.5 | Supported (latest 3.9.6) | 3 (CVE-2026-59739, CVE-2026-59969, CVE-2026-79993) |
CVE counts are ZooKeeper's own advisories matched against the upstream version. The Apache ZooKeeper project does not assess end-of-life lines against new advisories, so "not assessed" means unknown, not safe.
What ZooKeeper 3.4.14 is exposed to
CVE-2023-44981 · CVSS 9.1 · fixed in 3.7.2, 3.8.3, 3.9.1
SASL quorum peer authentication bypass, giving full read-write access to the data tree. Applies when quorum.auth.enableSasl=true.
Find the ZooKeeper Storm is using
grep -A3 storm.zookeeper.servers conf/storm.yaml # The client is shaded into storm-shaded-deps (Storm 2.x and 3.x) unzip -l lib/storm-shaded-deps-*.jar | grep -m1 'shade/org/apache/zookeeper' # Version of the ensemble echo srvr | nc zk1.internal 2181 | head -1
Can Apache Storm run without ZooKeeper?
No. Every Storm release requires ZooKeeper. In large clusters, Pacemaker can take worker heartbeats off ZooKeeper, but Nimbus leadership, assignments and the rest of the cluster state stay there.
Storm 3.1.0 (12 September 2026) is the current release, and is primarily a security release. Storm 2.8.9 (22 July 2026) is the final 2.x release, and the project ships no further bug fixes or security patches for 2.x. Storm 3.x requires Java 25.
Your options
Upgrade to Storm 3.1
The Java API is backwards-compatible with 2.x. The work is Java 25 across hosts and dependencies, and porting any Clojure topologies, since 3.0 removed the Clojure DSL. 3.1.0 still bundles ZooKeeper 3.9.5.
Patch Storm 2.x and its ZooKeeper
OSSeva ships patched, signed Storm 2.x builds, patches the ZooKeeper ensemble under them, and provides VEX statements for the bundled client your scanner flags.
Most teams buy this at the product level: keep the Apache Storm estate supported, including the ZooKeeper under it. See Apache Storm extended support.
Frequently asked questions
Is Storm 2.x end of life?
Yes. Storm 2.8.9, released on 22 July 2026, is the final 2.x release, and the branch is no longer maintained.
Which ZooKeeper does Storm bundle?
Storm 2.8.5 to 2.8.9, 3.0.0 and 3.1.0 build against ZooKeeper 3.9.5, which predates the fixes released in 3.9.6 in September 2026. Storm 2.0 to 2.3 used 3.4.14, and 2.4 and 2.5 used 3.5.9, both from end-of-life lines.
Does Storm 3 still need ZooKeeper?
Yes. The Storm 3.1.0 cluster setup guide still starts with setting up a ZooKeeper cluster, and storm.zookeeper.servers is still mandatory. Storm 3.0 added opt-in Zstd compression for the cluster state it writes to ZooKeeper.
Can Storm leak its ZooKeeper credentials?
Storm 3.1.0 fixed CVE-2026-82433 and CVE-2026-82434, which exposed the ZooKeeper authentication payload through Nimbus and the UI to users with limited permissions. The advisories list 3.0.0 as affected, and the 3.1.0 announcement tells 2.x users to treat its issues as unpatched there. The project's mitigation includes rotating the ZooKeeper credentials.
What does Pacemaker change?
Pacemaker is a Storm daemon that keeps worker heartbeats in memory instead of writing them to ZooKeeper, which the documentation describes as a bottleneck in large clusters. All other cluster state still goes to ZooKeeper.
Keep Apache Storm and the ZooKeeper under it supported.
Send us your versions; we reply with coverage, exposure and a plan within five working days.