Denial of Service Vulnerability in Apache ZooKeeper Affects Multiple Versions
CVE-2026-100302

7.1HIGH

Key Information:

Vendor

Apache
Status
Apache Zookeeper
Vendor
CVE Published:
4 November 2026

What is CVE-2026-100302?

A vulnerability in the multiRead request handler of Apache ZooKeeper allows an attacker to execute a denial of service attack by sending a small request that references large znodes multiple times. This leads to excessive memory allocation, resulting in an OutOfMemoryError and server crash. The vulnerability affects versions 3.7.0 to 3.9.6. Users are advised to upgrade to version 3.9.7, where configurable limits have been introduced to manage the number of read operations and the total size of the responses.

Affected Version(s)

Apache ZooKeeper 3.9.0 <= 3.9.6

Apache ZooKeeper 3.8.0 <= 3.8.7

References

https://lists.apache.org/thread.html/gj2vxwx8myq31js6tvb7...
vendor-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.