{"id":"CVE-2026-100302","kind":"vulnerability","aliases":["CVE-2026-100302"],"related":[],"title":"Apache ZooKeeper: multiRead requests can exhaust server memory and crash it","description":"Allocation of Resources Without Limits or Throttling in the multiRead request handler of Apache ZooKeeper allows a remote attacker to crash the server (denial of service) with a single small request.\n\nThe multiRead handler places no limit on the number of bundled read operations or on the cumulative size of the response it builds in memory. Because each operation's result is fully materialized and retained before serialization, a request that is small on the wire — within the jute.maxbuffer limit — but that references a large znode many times can force the server to allocate far more heap than the request size implies, exhausting the JVM heap and terminating the server with an OutOfMemoryError. Neither jute.maxbuffer nor largeRequestMaxBytes prevents this, as both bound only the inbound request, not the response.\n\nThis issue affects Apache ZooKeeper from 3.7.0 through 3.9.6. Users are recommended to upgrade to version 3.9.7, which enforces configurable limits on the multiRead operation count and cumulative response size.","summary":"A single small multiRead request can reference a large znode many times, forcing ZooKeeper to allocate far more heap than the request size suggests. The resulting OutOfMemoryError terminates the server, causing a denial of service.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","kafka","package","self-hosted","zookeeper"],"not_affected_if":["version-outside-3.7.0-to-3.9.6"],"how_to_check":"- Check the running version of Apache ZooKeeper; affected releases are `3.7.0` through `3.9.6`.\n- Confirm whether the server accepts multiRead requests from clients that you do not fully trust (unknown from sources whether a specific configuration is required).","fix":"- Apache ZooKeeper: upgrade to `3.9.7`, which enforces configurable limits on multiRead operation count and cumulative response size.","status":"open","published_at":"2026-11-04T11:17:07+00:00","first_seen_at":"2026-11-04T11:26:45+00:00","triaged_at":"2026-11-04T11:27:31+00:00","updated_at":"2026-11-04T11:27:31+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-04T11:27:31Z","model":"claude-haiku-5-5","output":{"fix":"- Apache ZooKeeper: upgrade to `3.9.7`, which enforces configurable limits on multiRead operation count and cumulative response size.","reach":"network","title":"Apache ZooKeeper: multiRead requests can exhaust server memory and crash it","impact":"medium","summary":"A single small multiRead request can reference a large znode many times, forcing ZooKeeper to allocate far more heap than the request size suggests. The resulting OutOfMemoryError terminates the server, causing a denial of service.","audience":"businesses","category":"package","nicknames":[],"who_cares":["zookeeper","self-hosted","java","kafka"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"Remote attacker crashes the ZooKeeper server with one small request","analyst_note":"","how_to_check":"- Check the running version of Apache ZooKeeper; affected releases are `3.7.0` through `3.9.6`.\n- Confirm whether the server accepts multiRead requests from clients that you do not fully trust (unknown from sources whether a specific configuration is required).","plain_action":"","needs_analyst":false,"not_affected_if":["version-outside-3.7.0-to-3.9.6"],"who_is_affected":"Teams running Apache ZooKeeper servers in the affected range, typically as coordination services behind Kafka, HBase or similar systems. Exposure depends on whether clients that can send multiRead requests can reach the server; the sources do not say whether any non-default configuration is needed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000721,"input_tokens":4356,"output_tokens":570,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-100302':13A,16A '-2026':12A,15A '3.7.0':194C '3.9.6':196C '3.9.7':204C 'affect':190C 'alloc':39B,59C,152C 'allow':74C 'apach':1A,72C,191C 'attack':77C 'bound':180C 'build':112C 'bundl':100C 'caus':54B 'configur':207C 'count':213C 'crash':10A,79C 'cumul':106C,215C 'cve':11A,14A 'denial':56B,82C 'enforc':206C 'exhaust':6A,161C 'far':40B,153C 'forc':36B,148C 'fulli':121C 'handler':70C,92C 'heap':42B,155C,164C 'host':22B 'impli':160C 'inbound':183C 'issu':189C 'java':17B 'jute.maxbuffer':137C,173C 'jvm':163C 'kafka':18B 'larg':32B,143C 'largerequestmaxbyt':175C 'limit':63C,95C,138C,208C 'mani':34B,145C 'materi':122C 'memori':8A,114C 'multiread':3A,27B,68C,91C,211C 'neither':172C 'number':98C 'oper':102C,117C,212C 'outofmemoryerror':50B,171C 'packag':19B 'place':93C 'prevent':176C 'read':101C 'recommend':199C 'refer':30B,141C 'remot':76C 'request':4A,28B,45B,69C,89C,128C,158C,184C 'resourc':61C 'respons':110C,187C,216C 'result':49B,119C 'retain':124C 'self':21B 'self-host':20B 'serial':126C 'server':7A,53B,81C,150C,168C 'servic':58B,84C 'singl':25B,87C 'size':46B,107C,159C,217C 'small':26B,88C,131C 'suggest':47B 'termin':51B,166C 'throttl':65C 'time':35B,146C 'upgrad':201C 'user':197C 'version':203C 'wire':134C 'within':135C 'without':62C 'znode':33B,144C 'zookeep':2A,23B,37B,73C,192C","nicknames":[],"mitigations":[],"who_affected":"Teams running Apache ZooKeeper servers in the affected range, typically as coordination services behind Kafka, HBase or similar systems. Exposure depends on whether clients that can send multiRead requests can reach the server; the sources do not say whether any non-default configuration is needed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","java","kafka","package","selfhosted","zookeeper"],"campaign_type":null,"first_public_at":"2026-11-04T11:17:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-100302","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100302","severity":null,"published_at":"2026-11-04T11:17:07+00:00","modified_at":"2026-11-04T11:17:07+00:00","first_seen_at":"2026-11-04T11:26:45+00:00","fetched_at":"2026-11-04T11:26:45+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}