CVE-2026-100300: Apache ZooKeeper: Unauthenticated persistent denial of service via unvalidated quota-node data and paths crashing the transaction-apply thread
Improper handling of exceptional conditions in the quota subsystem of Apache ZooKeeper allows an attacker able to write under the /zookeeper/quota subtree — unauthenticated on default deployments, where that subtree is world-writable — to crash the server's critical request-processing thread and render the on-disk data directory permanently unbootable.
This issue affects Apache ZooKeeper up to and including 3.9.6. Users are recommended to upgrade to version 3.8.8 or 3.9.7, which fixes the issue.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache ZooKeeperto a version that resolves this vulnerability.Fixed in 3.8.8 - Upgrade
Upgrade
Apache ZooKeeperto a version that resolves this vulnerability.Fixed in 3.9.7
Event History
Frequently Asked Questions
Are default Apache ZooKeeper deployments exposed?
Yes. On default deployments, the /zookeeper/quota subtree is world-writable, so an unauthenticated attacker can write there and exploit the issue.
What access does an attacker need?
The attacker needs the ability to write under /zookeeper/quota. No authentication is required where the default world-writable permissions on that subtree are in place.
What is the operational impact of exploitation?
Exploitation can crash ZooKeeper's critical request-processing thread and cause a persistent denial of service. It can also leave the on-disk data directory permanently unbootable.
Which versions should be upgraded?
The issue affects Apache ZooKeeper through 3.9.6. Upgrade to 3.8.8 or 3.9.7.