High [CVE-2026-100302] Allocation of Resources Without Limits or Throttling in the multiRead request handler of Apache ZooKeeper allows a remote attacker to crash the server (denial of service) with a single small request
This high-severity Apache Software Foundation advisory covers CVE-2026-100302 affecting Apache ZooKeeper.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Get an email when Apache Software Foundation Data & Analytics (Spark/Hadoop/Gravitino) publishes the next one.
See Apache Software Foundation Data & Analytics (Spark/Hadoop/Gravitino)'s last 90 days of advisories first. Then choose the free weekly digest, or a free month of real-time alerts with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
Summary
Allocation of Resources Without Limits or Throttling in the multiRead request handler of Apache ZooKeeper allows a remote attacker to crash the server (denial of service) with a single small request.
The multiRead handler places no limit on the number of bundled read operations or on the cumulative size of the response it builds in memory.
Because each operation's result is fully materialized and retained before serialization, a request that is small on the wire — within the jute.maxbuffer limit — but that references a large znode many times can force the server to allocate far more heap than the request size implies, exhausting the JVM heap and terminating the server with an OutOfMemoryError.
Neither jute.maxbuffer nor largeRequestMaxBytes prevents this, as both bound only the inbound request, not the response.
This issue affects Apache ZooKeeper from 3.7.0 through 3.9.6. Users are recommended to upgrade to version 3.9.7, which enforces configurable limits on the multiRead operation count and cumulative response size.
- 3.7.0 through 3.9.6.
- through 3.9.6
Official advisory · high-confidence parse· fetched 13 hours ago·verify at source
Mitigation checklist
- The multiRead handler places no limit on the number of bundled read operations or on the cumulative size of the response it builds in memory.
- Because each operation's result is fully materialized and retained before serialization, a request that is small on the wire — within the jute.maxbuffer limit — but that references a large znode many times can force the server to allocate far more heap than the request size implies, exhausting the JVM heap and terminating the server with an OutOfMemoryError.
- Users are recommended to upgrade to version 3.9.7, which enforces configurable limits on the multiRead operation count and cumulative response size.
Official advisory · high-confidence parse· fetched 13 hours ago·verify at source
More Apache Software Foundation advisories
- CVE-2026-115448Nov 4, 2026Uncontrolled recursion in Apache ZooKeeper
- CVE-2026-100300Nov 4, 2026Improper handling of exceptional conditions in the quota subsystem of Apache ZooKeeper
- CVE-2026-100252Nov 4, 2026Improper Authorization vulnerability in Apache ZooKeeper
- CVE-2026-100235Nov 4, 2026Apache ZooKeeper improper access control
- CVE-2026-84501Sep 16, 2026unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's
- CVE-2026-84439Sep 16, 2026When audit logging is enabled (zookeeper.audit.enable=true), an unauthenticated attacker
Android app · Google Play
Monitor future Apache Software Foundation CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.