---
id: "CVE-2026-100300"
kind: "vulnerability"
aliases: ["CVE-2026-100300"]
title: "Apache ZooKeeper: quota handling crash leaves data directory permanently unbootable"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["hadoop", "kafka", "kubernetes", "package", "self-hosted", "zookeeper"]
not_affected_if: ["fixed-version", "restricted-acl"]
published_at: "2026-11-04T11:17:06+00:00"
first_seen_at: "2026-11-04T11:26:45+00:00"
updated_at: "2026-11-04T11:27:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100300", "first_seen_at": "2026-11-04T11:26:45+00:00"}]
---

# Apache ZooKeeper: quota handling crash leaves data directory permanently unbootable

Apache ZooKeeper mishandles exceptional conditions in its quota subsystem, so a write under /zookeeper/quota can crash the request-processing thread. The on-disk data directory then cannot be started again.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed ZooKeeper version, for example from the `zkServer.sh` banner or the `zookeeper-*.jar` name in the lib directory, and compare it with the affected range.
- Check whether the `/zookeeper/quota` subtree is writable by clients that are not authenticated, for example with `getAcl /zookeeper/quota` in `zkCli.sh`.

## Fix

- Apache ZooKeeper 3.8.x: upgrade to `3.8.8`
- Apache ZooKeeper 3.9.x: upgrade to `3.9.7`

## Timeline

- 2026-11-04T11:26:45+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-100300

## From the sources

Improper handling of exceptional conditions in the quota subsystem of Apache ZooKeeper allows an attacker able to write under the /zookeeper/quota subtree — unauthenticated on default deployments, where that subtree is world-writable — to crash the server's critical request-processing thread and render the on-disk data directory permanently unbootable.

This issue affects Apache ZooKeeper up to and including 3.9.6. Users are recommended to upgrade to version 3.8.8 or 3.9.7, which fixes the issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_