Read the docs
TI-2026-85019 Aliases CVE-2026-100302GHSA-48x8-7x62-q6q9

Denial of service in Apache ZooKeeper multiRead request handling

Priority LOW 32CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Deferred Red Hat: fix deferred

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-770.

Summary

Apache ZooKeeper 3.8.0 through 3.8.7 and 3.9.0 through 3.9.6 are affected. The multiRead handler places no limit on bundled read operations or cumulative response size, so each result is retained in memory without bound (CWE-770). A remote attacker with low privileges can send one small request that references a large znode many times, exhausting the JVM heap and crashing the server with an OutOfMemoryError. The jute.maxbuffer and largeRequestMaxBytes limits bound only the inbound request, so they do not prevent this.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

Allocation of Resources Without Limits or Throttling in the multiRead request handler of Apache ZooKeeper allows a remote attacker to crash the server (denial of service) with a single small request. The multiRead handler places no limit on the number of bundled read operations or on the cumulative size of the response it builds in memory. Because each operation's result is fully materialized and retained before serialization, a request that is small on the wire — within the jute.maxbuffer limit — but that references a large znode many times can force the server to allocate far more heap than the request size implies, exhausting the JVM heap and terminating the server with an OutOfMemoryError. Neither jute.maxbuffer nor largeRequestMaxBytes prevents this, as both bound only the inbound request, not the response. This issue affects Apache ZooKeeper from 3.7.0 through 3.9.6. Users are recommended to upgrade to version 3.9.7, which enforces configurable limits on the multiRead operation count and cumulative response size.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00528 44th percentileScored 2026-11-07
Fix Deferred Red Hat: fix deferred

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache ZooKeeper3.9.0 – 3.9.6; 3.8.0 – 3.8.7—No fix listedCNA
  • Apache ZooKeeper VendorApache Affected 3.9.0 – 3.9.6; 3.8.0 – 3.8.7 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:apache:zookeeper:*:*:*:*:*:*:*:*——Apache
  • cpe:2.3:a:apache:zookeeper:*:*:*:*:*:*:*:* Versions — — ·Apache

Remediation

Upgrade Apache ZooKeeper to 3.9.7, which the source description recommends and which adds configurable limits on multiRead operation count and cumulative response size. Red Hat lists these products as affected without a fix: Red Hat AMQ Broker 7 (plan: none available), Red Hat Fuse 7 (no fix planned), Red Hat Offline Knowledge Portal (plan: none available) and Red Hat OpenShift AI (RHOAI) (plan: none available).

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat AMQ Broker 7AffectedNo fix yet: Fix deferred
Red Hat Fuse 7AffectedNo fix planned: Out of support scope
Red Hat Offline Knowledge PortalAffectedNo fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-100302
  2. 2026-11-04 Alias added: GHSA-48x8-7x62-q6q9
  3. 2026-11-04 CISA SSVC decision points changed
  4. 2026-11-04 Priority changed: MEDIUM → LOW
  5. 2026-11-04 Affected versions changed · Red Hat
  6. 2026-11-04 CVSS score added · Red Hat

References

Advisory 1

  • TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
  • TI-2024-30292 Apache OFBiz: Confused controller-view authorization logic (forced browsing) KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-26062 Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-21190 Apache OFBiz: Path traversal leading to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-18186 Apache HugeGraph-Server: Command execution in gremlin KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-25106 Deserialization of untrusted data in Apache ActiveMQ KEVCVSS 3.1CRITICAL 10.0
See all 4053 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences