Apache Curator is a Java/JVM client library for Apache ZooKeeper, a distributed coordination service. It includes a high level API framework and utilities to make using Apache ZooKeeper much easier and more reliable. It also includes recipes for common use cases and extensions such as service discovery and a Java 8 asynchronous DSL.
Apache Curator suffers from an unsafe deserialization vulnerability in its service-discovery component. The discovery payload is deserialized with Jackson polymorphic typing configured as Id.CLASS, which lets the serialized data name the Java class to instantiate, so an attacker who can publish a crafted discovery record (via ZooKeeper write access or rogue-service registration) can drive gadget-based deserialization on a consumer that reads it, resulting in remote code execution where a suitable gadget is present on that consumer's classpath.