Apache ZooKeeper vulnerable to denial of service in multiRead request handling (CVE-2026-100302)
Original title: CVE-2026-100302: Apache ZooKeeper: Denial of service through unbounded memory allocation in multiRead request handling
A remote attacker can crash the server with a single small request by overwhelming memory allocation.
Apache ZooKeeper's multiRead request handler allows allocation of resources without limits. A remote attacker can cause a denial of service with a small request. Affected in versions 3.9.0-3.9.6 and 3.8.0-3.8.7. CVSS 7.1 (high).
Unconfirmed: Fixed versions not specified
- CVSS 7.1 (high)
- Single small request causes crash
- Unbounded memory allocation
- PR:L in CVSS
Impact: denial of service via unbounded memory allocation
- 1.Upgrade to a patched version
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-100302 | — | — | — |
From the original article
Posted by Andor Molnar on Nov 03 Severity: important CVSS 4. 0: 7. 1 (high) CVSS:4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.