Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhigh

Apache ZooKeeper Hit by Four CVEs for DoS and SASL Bypass

1 source · 4 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Four CVEs in Apache ZooKeeper allow unauthenticated DoS and client-controlled authorization bypass, affecting 3.8.0-3.9.7.

Apache ZooKeeper has four vulnerabilities disclosed together by oss-security. CVE-2026-100252 enables a client to bypass SASL authorization checks by supplying an arbitrary authzid on the client port. CVE-2026-100300 allows unauthenticated persistent DoS by writing to the /zookeeper/quota subtree, crashing the transaction-apply thread on default deployments. CVE-2026-100302 causes DoS through unbounded memory allocation in multiRead request handling with a single small request, rated high severity. CVE-2026-115448 permits unbounded recursion in snapshot serialization, allowing a client with open ACLs to render the server unrecoverable. Affected versions span 3.8.0-3.8.8 and 3.9.0-3.9.7 with no patches yet.

Key facts
  • CVE-2026-100252: client-supplied authzid bypasses SASL on client port
  • CVE-2026-100300: unauthenticated DoS via /zookeeper/quota subtree
  • CVE-2026-100302: unbounded memory DoS in multiRead, CVSS 7.1
  • CVE-2026-115448: unbounded recursion in snapshots, CVSS 8.7
  • Affects 3.8.0-3.8.8 and 3.9.0-3.9.7
  • Default open ACL enables recursion attack
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Nov 3, 2026oss-security discloses four ZooKeeper CVEs · oss-security

What each outlet adds

beyond the shared facts
  • oss-securityDiscloses four CVEs in one post for Apache ZooKeeper
CVEs
CVE-2026-115448CVE-2026-100302CVE-2026-100300CVE-2026-100252
Vendors
Apache
Products
ZooKeeper

Coverage

oldest first · one row per article · UTC
  1. · 9h ago oss-securityFirst report

    Apache ZooKeeper SASL authorization bypass on client port (CVE-2026-100252)

    Affects 3.8.0-3.9.6; client-supplied authzid bypasses SASL checks

  2. · 9h ago oss-security

    Apache ZooKeeper quota subsystem allows unauthenticated DoS (CVE-2026-100300)

    Affects ZooKeeper 3.8.0-3.9.6; unauthenticated DoS by writing to /zookeeper/quota subtree

  3. · 9h ago oss-security

    Apache ZooKeeper vulnerable to denial of service in multiRead request handling (CVE-2026-100302)

    A remote attacker can crash the server with a single small request by overwhelming memory allocation.

  4. · 8h ago oss-security

    Apache ZooKeeper vulnerable to unbounded recursion in snapshot serialization (CVE-2026-115448)

    A client can cause the server to become unrecoverable by creating znodes due to no depth limit in recursion.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-100252
———
CVE-2026-100300
———
CVE-2026-100302
———
CVE-2026-115448
———