CVE-2026-100302

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-100302", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-09-25T17:59:47.459Z", "datePublished": "2026-11-04T10:46:20.042Z", "dateUpdated": "2026-11-04T15:18:55.017Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-11-04T10:46:20.042Z"}, "title": "Apache ZooKeeper: Denial of service through unbounded memory allocation in multiRead request handling", "problemTypes": [{"descriptions": [{"description": "CWE-770 Allocation of resources without limits or throttling", "lang": "en", "cweId": "CWE-770", "type": "CWE"}]}], "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache ZooKeeper", "packageURL": "pkg:maven/org.apache.zookeeper/zookeeper", "versions": [{"status": "affected", "version": "3.9.0", "lessThanOrEqual": "3.9.6", "versionType": "maven"}, {"status": "affected", "version": "3.8.0", "lessThanOrEqual": "3.8.7", "versionType": "maven"}], "defaultStatus": "unaffected", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "org.apache.zookeeper:zookeeper"}], "descriptions": [{"value": "Allocation of Resources Without Limits or Throttling in the multiRead request handler of Apache ZooKeeper allows a remote attacker to crash the server (denial of service) with a single small request.\n\nThe multiRead handler places no limit on the number of bundled read operations or on the cumulative size of the response it builds in memory. Because each operation's result is fully materialized and retained before serialization, a request that is small on the wire \u2014 within the jute.maxbuffer limit \u2014 but that references a large znode many times can force the server to allocate far more heap than the request size implies, exhausting the JVM heap and terminating the server with an OutOfMemoryError. Neither jute.maxbuffer nor largeRequestMaxBytes prevents this, as both bound only the inbound request, not the response.\n\nThis issue affects Apache ZooKeeper from 3.7.0 through 3.9.6. Users are recommended to upgrade to version 3.9.7, which enforces configurable limits on the multiRead operation count and cumulative response size.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Allocation of Resources Without Limits or Throttling in the <code>multiRead</code> request handler of Apache ZooKeeper allows a remote attacker to crash the server (denial of service) with a single small request.<br><span><br>The </span><code>multiRead</code><span> handler places no limit on the number of bundled read operations or on the cumulative size of the response it builds in memory. Because each operation's result is fully materialized and retained before serialization, a request that is small on the wire \u2014 within the </span><code>jute.maxbuffer</code><span> limit \u2014 but that references a large znode many times can force the server to allocate far more heap than the request size implies, exhausting the JVM heap and terminating the server with an </span><code>OutOfMemoryError</code><span>. Neither </span><code>jute.maxbuffer</code><span> nor </span><code>largeRequestMaxBytes</code><span> prevents this, as both bound only the inbound request, not the response.<br></span><span><br>This issue affects Apache ZooKeeper from 3.7.0 through 3.9.6. Users are recommended to upgrade to version 3.9.7, which enforces configurable limits on the multiRead operation count and cumulative response size.</span></p>"}]}], "references": [{"url": "https://lists.apache.org/thread.html/gj2vxwx8myq31js6tvb7bgls4nnxohj7", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "important"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"scenarios": [{"lang": "en", "value": "GENERAL"}], "format": "CVSS", "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 7.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}}], "x_generator": {"engine": "Vulnogram 1.0.3"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/11/03/12"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-11-04T11:09:44.818Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-100302", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-04T14:34:46.610023Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-04T15:18:55.017Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/11/03/12"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-11-04T11:09:44.818Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-100302", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-04T14:34:46.610023Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-04T15:09:13.188Z"}}], "cna": {"title": "Apache ZooKeeper: Denial of service through unbounded memory allocation in multiRead request handling", "source": {"discovery": "UNKNOWN"}, "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "important"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache ZooKeeper", "versions": [{"status": "affected", "version": "3.9.0", "versionType": "maven", "lessThanOrEqual": "3.9.6"}, {"status": "affected", "version": "3.8.0", "versionType": "maven", "lessThanOrEqual": "3.8.7"}], "packageURL": "pkg:maven/org.apache.zookeeper/zookeeper", "packageName": "org.apache.zookeeper:zookeeper", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.apache.org/thread.html/gj2vxwx8myq31js6tvb7bgls4nnxohj7", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.3"}, "descriptions": [{"lang": "en", "value": "Allocation of Resources Without Limits or Throttling in the multiRead request handler of Apache ZooKeeper allows a remote attacker to crash the server (denial of service) with a single small request.\n\nThe multiRead handler places no limit on the number of bundled read operations or on the cumulative size of the response it builds in memory. Because each operation's result is fully materialized and retained before serialization, a request that is small on the wire \u2014 within the jute.maxbuffer limit \u2014 but that references a large znode many times can force the server to allocate far more heap than the request size implies, exhausting the JVM heap and terminating the server with an OutOfMemoryError. Neither jute.maxbuffer nor largeRequestMaxBytes prevents this, as both bound only the inbound request, not the response.\n\nThis issue affects Apache ZooKeeper from 3.7.0 through 3.9.6. Users are recommended to upgrade to version 3.9.7, which enforces configurable limits on the multiRead operation count and cumulative response size.", "supportingMedia": [{"type": "text/html", "value": "<p>Allocation of Resources Without Limits or Throttling in the <code>multiRead</code> request handler of Apache ZooKeeper allows a remote attacker to crash the server (denial of service) with a single small request.<br><span><br>The </span><code>multiRead</code><span> handler places no limit on the number of bundled read operations or on the cumulative size of the response it builds in memory. Because each operation's result is fully materialized and retained before serialization, a request that is small on the wire \u2014 within the </span><code>jute.maxbuffer</code><span> limit \u2014 but that references a large znode many times can force the server to allocate far more heap than the request size implies, exhausting the JVM heap and terminating the server with an </span><code>OutOfMemoryError</code><span>. Neither </span><code>jute.maxbuffer</code><span> nor </span><code>largeRequestMaxBytes</code><span> prevents this, as both bound only the inbound request, not the response.<br></span><span><br>This issue affects Apache ZooKeeper from 3.7.0 through 3.9.6. Users are recommended to upgrade to version 3.9.7, which enforces configurable limits on the multiRead operation count and cumulative response size.</span></p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770 Allocation of resources without limits or throttling"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-11-04T10:46:20.042Z"}}}, "cveMetadata": {"cveId": "CVE-2026-100302", "state": "PUBLISHED", "dateUpdated": "2026-11-04T15:18:55.017Z", "dateReserved": "2026-09-25T17:59:47.459Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-11-04T10:46:20.042Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.zookeeper:zookeeper", "packageURL": "pkg:maven/org.apache.zookeeper/zookeeper", "product": "Apache ZooKeeper", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "3.9.6", "status": "affected", "version": "3.9.0", "versionType": "maven"}, {"lessThanOrEqual": "3.8.7", "status": "affected", "version": "3.8.0", "versionType": "maven"}]}], "source": "security@apache.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Allocation of Resources Without Limits or Throttling in the multiRead request handler of Apache ZooKeeper allows a remote attacker to crash the server (denial of service) with a single small request.\n\nThe multiRead handler places no limit on the number of bundled read operations or on the cumulative size of the response it builds in memory. Because each operation's result is fully materialized and retained before serialization, a request that is small on the wire \u2014 within the jute.maxbuffer limit \u2014 but that references a large znode many times can force the server to allocate far more heap than the request size implies, exhausting the JVM heap and terminating the server with an OutOfMemoryError. Neither jute.maxbuffer nor largeRequestMaxBytes prevents this, as both bound only the inbound request, not the response.\n\nThis issue affects Apache ZooKeeper from 3.7.0 through 3.9.6. Users are recommended to upgrade to version 3.9.7, which enforces configurable limits on the multiRead operation count and cumulative response size."}], "id": "CVE-2026-100302", "lastModified": "2026-11-04T16:17:31.093", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@apache.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-100302", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-04T14:34:46.610023Z", "version": "2.0.3"}}]}, "published": "2026-11-04T11:17:07.023", "references": [{"source": "security@apache.org", "url": "https://lists.apache.org/thread.html/gj2vxwx8myq31js6tvb7bgls4nnxohj7"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/11/03/12"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "security@apache.org", "type": "Secondary"}]}

{"bugzilla": {"description": "org.apache.zookeeper/zookeeper: Apache ZooKeeper: Denial of Service via unbounded multiRead response memory allocation", "id": "2566853", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2566853"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["A flaw was found in Apache ZooKeeper. An authenticated remote attacker can cause a Denial of Service (DoS) by submitting a request containing multiple bundled read operations for large data nodes. Because the multiRead handler does not restrict the cumulative response size generated in memory, the server exhausts available memory and terminates unexpectedly."], "mitigation": {"lang": "en:us", "value": "Restrict network access to the Apache ZooKeeper client port (default TCP 2181) to trusted internal hosts and cluster members using firewall controls.\n1. Restrict port access using `firewalld`:\n```\nfirewall-cmd --permanent --zone=trusted --add-source=<TRUSTED_HOST_IP>\nfirewall-cmd --permanent --remove-port=2181/tcp\nfirewall-cmd --reload\n```\n2. Caveats:\nLimiting access to ZooKeeper prevents unlisted hosts and applications from reaching the ensemble. Ensure all legitimate cluster nodes, dependent services, and monitoring probes are permitted before applying the firewall policy.\nWarning: Reloading the firewall configuration using `firewall-cmd --reload` applies modifications immediately and may drop or briefly disrupt active network connections. Verify all rules in advance."}, "name": "CVE-2026-100302", "package_state": [{"cpe": "cpe:/a:redhat:amq_broker:7", "fix_state": "Fix deferred", "package_name": "zookeeper", "product_name": "Red Hat AMQ Broker 7"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Out of support scope", "package_name": "zookeeper", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:offline_knowledge_portal:1", "fix_state": "Fix deferred", "package_name": "offline-knowledge-portal/rhokp-rhel9", "product_name": "Red Hat Offline Knowledge Portal"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-modelmesh-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-spark-operator-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-th06-cpu-torch210-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-th06-cpu-torch291-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-th06-cuda130-torch210-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-th06-cuda130-torch291-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-th06-rocm64-torch291-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-th-torch-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-th-torch-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}], "public_date": "2026-11-04T10:46:20Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-100302\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-100302\nhttp://www.openwall.com/lists/oss-security/2026/11/03/12\nhttps://lists.apache.org/thread.html/gj2vxwx8myq31js6tvb7bgls4nnxohj7"], "statement": "This vulnerability is rated Moderate because triggering the denial of service requires authenticated client access to query existing nodes, and the blast radius is confined to service availability without compromising data confidentiality or system integrity. In typical Red Hat deployments, Apache ZooKeeper is not exposed to untrusted public networks and operates within isolated cluster environments. While an authenticated client can trigger heap exhaustion leading to process termination, the condition does not permit arbitrary code execution or data leakage.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.9.0,3.9.6]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.8.0,3.8.7]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache ZooKeeper", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "zookeeper", "vendor": "apache"}], "created": "2026-11-04T12:30:10.983024+00:00", "updated": "2026-11-04T12:45:13.690392+00:00", "vendors": ["apache", "apache$PRODUCT$zookeeper"]}