High [CVE-2026-100300] Improper handling of exceptional conditions in the quota subsystem of Apache ZooKeeper allows an attacker able to write under the /zookeeper/quota subtree — unauthenticated on default deployments, where that subtree is world-writable — to crash the server's critical request-processing thread and render the on-disk data directory permanently unbootable
This high-severity Apache Software Foundation advisory covers CVE-2026-100300 affecting Apache ZooKeeper.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Get an email when Apache Software Foundation Data & Analytics (Spark/Hadoop/Gravitino) publishes the next one.
See Apache Software Foundation Data & Analytics (Spark/Hadoop/Gravitino)'s last 90 days of advisories first. Then choose the free weekly digest, or a free month of real-time alerts with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
Summary
Improper handling of exceptional conditions in the quota subsystem of Apache ZooKeeper allows an attacker able to write under the /zookeeper/quota subtree — unauthenticated on default deployments, where that subtree is world-writable — to crash the server's critical request-processing thread and render the on-disk data directory permanently unbootable.
This issue affects Apache ZooKeeper up to and including 3.9.6. Users are recommended to upgrade to version 3.8.8 or 3.9.7, which fixes the issue.
- 3.9.6
Official advisory · high-confidence parse· fetched 14 hours ago·verify at source
- 3.8.8
- 3.9.7
Official advisory · high-confidence parse· fetched 14 hours ago·verify at source
Mitigation checklist
- Users are recommended to upgrade to version 3.8.8 or 3.9.7, which fixes the issue.
Official advisory · high-confidence parse· fetched 14 hours ago·verify at source
More Apache Software Foundation advisories
- CVE-2026-100302Nov 4, 2026Apache ZooKeeper denial of service
- CVE-2026-115448Nov 4, 2026Uncontrolled recursion in Apache ZooKeeper
- CVE-2026-100252Nov 4, 2026Improper Authorization vulnerability in Apache ZooKeeper
- CVE-2026-100235Nov 4, 2026Apache ZooKeeper improper access control
- CVE-2026-84501Sep 16, 2026unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's
- CVE-2026-84439Sep 16, 2026When audit logging is enabled (zookeeper.audit.enable=true), an unauthenticated attacker
Android app · Google Play
Monitor future Apache Software Foundation CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.