{"id":"CVE-2026-100300","kind":"vulnerability","aliases":["CVE-2026-100300"],"related":[],"title":"Apache ZooKeeper: quota handling crash leaves data directory permanently unbootable","description":"Improper handling of exceptional conditions in the quota subsystem of Apache ZooKeeper allows an attacker able to write under the /zookeeper/quota subtree — unauthenticated on default deployments, where that subtree is world-writable — to crash the server's critical request-processing thread and render the on-disk data directory permanently unbootable.\n\nThis issue affects Apache ZooKeeper up to and including 3.9.6. Users are recommended to upgrade to version 3.8.8 or 3.9.7, which fixes the issue.","summary":"Apache ZooKeeper mishandles exceptional conditions in its quota subsystem, so a write under /zookeeper/quota can crash the request-processing thread. The on-disk data directory then cannot be started again.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hadoop","kafka","kubernetes","package","self-hosted","zookeeper"],"not_affected_if":["fixed-version","restricted-acl"],"how_to_check":"- Check the installed ZooKeeper version, for example from the `zkServer.sh` banner or the `zookeeper-*.jar` name in the lib directory, and compare it with the affected range.\n- Check whether the `/zookeeper/quota` subtree is writable by clients that are not authenticated, for example with `getAcl /zookeeper/quota` in `zkCli.sh`.","fix":"- Apache ZooKeeper 3.8.x: upgrade to `3.8.8`\n- Apache ZooKeeper 3.9.x: upgrade to `3.9.7`","status":"open","published_at":"2026-11-04T11:17:06+00:00","first_seen_at":"2026-11-04T11:26:45+00:00","triaged_at":"2026-11-04T11:27:31+00:00","updated_at":"2026-11-04T11:27:31+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-04T11:27:31Z","model":"claude-haiku-5-5","output":{"fix":"- Apache ZooKeeper 3.8.x: upgrade to `3.8.8`\n- Apache ZooKeeper 3.9.x: upgrade to `3.9.7`","reach":"network","title":"Apache ZooKeeper: quota handling crash leaves data directory permanently unbootable","impact":"medium","summary":"Apache ZooKeeper mishandles exceptional conditions in its quota subsystem, so a write under /zookeeper/quota can crash the request-processing thread. The on-disk data directory then cannot be started again.","audience":"businesses","category":"package","nicknames":[],"who_cares":["zookeeper","kafka","hadoop","self-hosted","kubernetes"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Server crashes and the data directory can no longer be started.","analyst_note":"","how_to_check":"- Check the installed ZooKeeper version, for example from the `zkServer.sh` banner or the `zookeeper-*.jar` name in the lib directory, and compare it with the affected range.\n- Check whether the `/zookeeper/quota` subtree is writable by clients that are not authenticated, for example with `getAcl /zookeeper/quota` in `zkCli.sh`.","plain_action":"","needs_analyst":false,"not_affected_if":["fixed-version","restricted-acl"],"who_is_affected":"Deployments running Apache ZooKeeper up to and including `3.9.6` are affected. Default deployments leave the `/zookeeper/quota` subtree world-writable, so an unauthenticated client on the network can trigger the crash; deployments that restrict that subtree's ACLs or run a fixed version can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000735,"input_tokens":4202,"output_tokens":630,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-100300':13A,16A '-2026':12A,15A '/zookeeper/quota':38B,76C '3.8.8':126C '3.9.6':118C '3.9.7':128C 'abl':71C 'affect':111C 'allow':68C 'apach':1A,25B,66C,112C 'attack':70C 'cannot':53B 'condit':29B,60C 'crash':5A,40B,90C 'critic':94C 'cve':11A,14A 'data':7A,50B,105C 'default':80C 'deploy':81C 'directori':8A,51B,106C 'disk':49B,104C 'except':28B,59C 'fix':130C 'hadoop':17B 'handl':4A,57C 'host':23B 'improp':56C 'includ':117C 'issu':110C,132C 'kafka':18B 'kubernet':19B 'leav':6A 'mishandl':27B 'on-disk':47B,102C 'packag':20B 'perman':9A,107C 'process':44B,97C 'quota':3A,32B,63C 'recommend':121C 'render':100C 'request':43B,96C 'request-process':42B,95C 'self':22B 'self-host':21B 'server':92C 'start':55B 'subsystem':33B,64C 'subtre':77C,84C 'thread':45B,98C 'unauthent':78C 'unboot':10A,108C 'upgrad':123C 'user':119C 'version':125C 'world':87C 'world-writ':86C 'writabl':88C 'write':36B,73C 'zookeep':2A,24B,26B,67C,113C","nicknames":[],"mitigations":[],"who_affected":"Deployments running Apache ZooKeeper up to and including `3.9.6` are affected. Default deployments leave the `/zookeeper/quota` subtree world-writable, so an unauthenticated client on the network can trigger the crash; deployments that restrict that subtree's ACLs or run a fixed version can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["hadoop","high","kafka","kubernetes","package","selfhosted","zookeeper"],"campaign_type":null,"first_public_at":"2026-11-04T11:17:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-100300","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100300","severity":null,"published_at":"2026-11-04T11:17:06+00:00","modified_at":"2026-11-04T11:17:06+00:00","first_seen_at":"2026-11-04T11:26:45+00:00","fetched_at":"2026-11-04T11:26:45+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}