Cyber ·
CVE-2026-100300: persistent unauthenticated DoS in Apache ZooKeeper
Important advisory (CVSS 4.0 8.7) on unvalidated data and quota paths in Apache ZooKeeper, which may cause persistent denial of service without authentication in default deployments.
Advisory CVE-2026-100300, published by Andor Molnar on November 3, 2026 and shared on the oss-sec list, describes improper handling of exceptional conditions in the Apache ZooKeeper quota subsystem. Unvalidated data or quota paths can interrupt the thread that applies transactions, causing persistent denial of service. According to the text, an attacker able to write to the /zookeeper/quota subtree can trigger the flaw, and that subtree is reachable without authentication in default deployments. The severity is rated important, with CVSS 4.0 of 8.7 (high), network attack vector, low complexity, no privileges required, no user interaction, and high impact on availability only. The affected versions listed are 3.9.0 through 3.9.6 and 3.8.0 through 3.8.7. The source is a machine translation, and the text received is cut off in the description, so the complete version should be read in the original advisory. Organizations running ZooKeeper should identify the versions in use, assess upgrading to a fixed release indicated by the project, restrict writes to the quota subtree to authorized identities, and segment the network where the service runs. This text does not indicate that Rota Nacional uses ZooKeeper and does not describe any platform feature related to the flaw.