Improper Handling of Exceptional Conditions in Apache ZooKeeper
CVE-2026-100300

8.7HIGH

Key Information:

Vendor

Apache
Status
Apache Zookeeper
Vendor
CVE Published:
4 November 2026

What is CVE-2026-100300?

This vulnerability arises from the improper handling of exceptional conditions in the quota subsystem of Apache ZooKeeper. It allows an unauthenticated attacker to write within the /zookeeper/quota subtree, which is configured as world-writable in default deployments. Exploiting this flaw can lead to a situation where the server's critical request-processing thread crashes, resulting in the on-disk data directory becoming permanently unbootable. To mitigate this issue, users should upgrade to Apache ZooKeeper versions 3.8.8 or 3.9.7, where the vulnerability has been addressed.

Affected Version(s)

Apache ZooKeeper 3.9.0 <= 3.9.6

Apache ZooKeeper 3.8.0 <= 3.8.7

References

https://lists.apache.org/thread.html/09pgg7rcpzz44noxgtvp...
vendor-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

cunyi li <xiaoheihei1107@gmail.com>
.