8.7 High

CVE-2026-100300 Apache ZooKeeper: Unauthenticated persistent denial of service via unvalidated quota-node data and paths crashing the transaction-apply thread

Description

Improper handling of exceptional conditions in the quota subsystem of Apache ZooKeeper allows an attacker able to write under the /zookeeper/quota subtree — unauthenticated on default deployments, where that subtree is world-writable — to crash the server's critical request-processing thread and render the on-disk data directory permanently unbootable. This issue affects Apache ZooKeeper up to and including 3.9.6. Users are recommended to upgrade to version 3.8.8 or 3.9.7, which fixes the issue.

CVSS 4.0 detail

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Exploitable remotely over the network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: None
Interaction: None
Confidentiality: None
Integrity: None
Availability: High
Confidentiality of other systems: None
Integrity of other systems: None
Availability of other systems: None

Affected products and versions

Product	Affected versions	Fixed in
Apache ZooKeeper 3.9	3.9.0 → 3.9.6	No fix stated
Apache ZooKeeper 3.8	3.8.0 → 3.8.7	No fix stated

References

lists.apache.org lists.apache.org

Timeline

Published November 4, 2026
Last modified November 4, 2026

The 19 CVEs of Apache ZooKeeper →

CVE-2026-100302 Apache ZooKeeper: Denial of service through unbounded memory allocation in multiRead request handling 7.1 High CVE-2026-115448 Apache ZooKeeper: Unbounded recursion in snapshot serialization allows a client to render the server unrecoverable 8.7 High CVE-2026-100252 Apache ZooKeeper: SASL authorization bypass on the client port through a client-supplied authorization ID 8.6 High CVE-2026-100235 Apache ZooKeeper: ACL enforcement bypass allows unauthorized operations to commit after an ACL revocation 6.0 Medium

Track this CVE