CVE-2026-100302: Apache ZooKeeper: Denial of service through unbounded memory allocation in multiRead request handling

Description

Allocation of Resources Without Limits or Throttling in the multiRead request handler of Apache ZooKeeper allows a remote attacker to crash the server (denial of service) with a single small request. The multiRead handler places no limit on the number of bundled read operations or on the cumulative size of the response it builds in memory. Because each operation's result is fully materialized and retained before serialization, a request that is small on the wire — within the jute.maxbuffer limit — but that references a large znode many times can force the server to allocate far more heap than the request size implies, exhausting the JVM heap and terminating the server with an OutOfMemoryError. Neither jute.maxbuffer nor largeRequestMaxBytes prevents this, as both bound only the inbound request, not the response. This issue affects Apache ZooKeeper from 3.7.0 through 3.9.6. Users are recommended to upgrade to version 3.9.7, which enforces configurable limits on the multiRead operation count and cumulative response size.

Text from the CVE.org record (apache).

How do I fix CVE-2026-100302?

Upgrade to a fixed release named by the vendor:

• Apache: 3.9.7

• The multiRead handler places no limit on the number of bundled read operations or on the cumulative size of the response it builds in memory. (Apache)
• Because each operation's result is fully materialized and retained before serialization, a request that is small on the wire — within the jute.maxbuffer limit — but that references a large znode many times can force the server to allocate far more heap than the request size implies, exhausting the JVM heap and terminating the server with an OutOfMemoryError. (Apache)
• Restrict network access to the Apache ZooKeeper client port (default TCP 2181) to trusted internal hosts and cluster members using firewall controls. 1. Restrict port access using `firewalld`: ``` firewall-cmd --permanent --zone=trusted --add-source= firewall-cmd --permanent --remove-port=2181/tcp firewall-cmd --reload ``` 2. Caveats: Limiting access to ZooKeeper prevents unlisted hosts and applications from reaching the ensemble. Ensure all legitimate cluster nodes, dependent services, and monitoring probes are permitted before applying the firewall policy. Warning: Reloading the firewall configuration using `firewall-cmd --reload` applies modifications immediately and may drop or briefly disrupt active network connections. Verify all rules in advance. (Red Hat)