Cyber ·
CVE-2026-100302: unbounded memory allocation in Apache ZooKeeper multiRead enables remote denial of service
A high-severity flaw (CVSS 4.0: 7.1) in the Apache ZooKeeper multiRead handler lets a remote attacker crash the server with a single small request. Versions 3.9.0 through 3.9.6 and 3.8.0 through 3.8.7 are listed as affected.
According to the advisory posted to the oss-sec feed on 3 November 2026, the multiRead request handler in Apache ZooKeeper does not limit resource allocation. A remote attacker with low privileges and no user interaction can send a small request that exhausts memory and brings the server down, which is a denial of service. The reported CVSS 4.0 vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N, with impact limited to availability. The affected versions are Apache ZooKeeper 3.9.0 through 3.9.6 and 3.8.0 through 3.8.7.
The source text is a machine translation of a mailing-list advisory, so the full description should be read in the original. To verify, consult the official Apache ZooKeeper advisory and the oss-sec list, confirm the installed version, and follow the fix guidance given by the maintainers before acting.