Apache ZooKeeper quota subsystem allows unauthenticated DoS (CVE-2026-100300)
Original title: CVE-2026-100300: Apache ZooKeeper: Unauthenticated persistent denial of service via unvalidated quota-node data and paths crashing the transaction-apply thread
Affects ZooKeeper 3.8.0-3.9.6; unauthenticated DoS by writing to /zookeeper/quota subtree
The Apache ZooKeeper project has disclosed a denial of service vulnerability in the quota subsystem. An attacker able to write under the /zookeeper/quota subtree can cause the transaction-apply thread to crash. This affects default deployments where the subtree is exposed. The issue is present in versions 3.8.0 through 3.8.7 and 3.9.0 through 3.9.6.
- Unauthenticated access on default deployments
- Crashes transaction-apply thread
- Persistent DoS via quota-node data
Impact: Denial of service by crashing transaction-apply thread
- CVEs
- CVE-2026-100300
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-100300 | — | — | — |
From the original article
Posted by Andor Molnar on Nov 03 Severity: important CVSS 4. 0: 8. 7 (high) CVSS:4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.