CVE-2026-100302: Apache ZooKeeper: Denial of service through unbounded memory allocation in multiRead request handling
Allocation of Resources Without Limits or Throttling in the multiRead request handler of Apache ZooKeeper allows a remote attacker to crash the server (denial of service) with a single small request.
The multiRead handler places no limit on the number of bundled read operations or on the cumulative size of the response it builds in memory. Because each operation's result is fully materialized and retained before serialization, a request that is small on the wire — within the jute.maxbuffer limit — but that references a large znode many times can force the server to allocate far more heap than the request size implies, exhausting the JVM heap and terminating the server with an OutOfMemoryError. Neither jute.maxbuffer nor largeRequestMaxBytes prevents this, as both bound only the inbound request, not the response.
This issue affects Apache ZooKeeper from 3.7.0 through 3.9.6. Users are recommended to upgrade to version 3.9.7, which enforces configurable limits on the multiRead operation count and cumulative response size.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache ZooKeeperto a version that resolves this vulnerability.Fixed in 3.9.7
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker with low privileges can exploit it by sending a crafted multiRead request. No user interaction is required.
Are default inbound request-size limits sufficient to prevent exploitation?
No. jute.maxbuffer and largeRequestMaxBytes limit only the inbound request size; a small request can still cause a much larger in-memory response by repeatedly referencing a large znode.
Which deployments are affected?
Apache ZooKeeper versions 3.7.0 through 3.9.6 are affected. Version 3.9.7 adds configurable limits for multiRead operation count and cumulative response size.
What is the impact if exploitation succeeds?
The multiRead handler can exhaust the JVM heap, causing an OutOfMemoryError and terminating the ZooKeeper server. The impact is denial of service.