UBUNTU-CVE-2026-100300: High severity ubuntu/zookeeper vulnerability

Published Nov 5, 2026

Updated

Improper handling of exceptional conditions in the quota subsystem of Apache ZooKeeper allows an attacker able to write under the /zookeeper/quota subtree — unauthenticated on default deployments, where that subtree is world-writable — to crash the server's critical request-processing thread and render the on-disk data directory permanently unbootable. This issue affects Apache ZooKeeper up to and including 3.9.6. Users are recommended to upgrade to version 3.8.8 or 3.9.7, which fixes the issue.

Affected Software

8 affected components

ubuntu/zookeeper*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache ZooKeeper to a version that resolves this vulnerability.
Fixed in 3.8.8
Upgrade
Upgrade Apache ZooKeeper to a version that resolves this vulnerability.
Fixed in 3.9.7

Event History

Nov 5, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed without authentication?

Default deployments are exposed if the /zookeeper/quota subtree remains world-writable, because an unauthenticated attacker can write there. Deployments that allow an attacker to write under that subtree are affected regardless of how that access is obtained.

What access does an attacker need to exploit this issue?

The attacker needs the ability to write under /zookeeper/quota. No authentication is required on default deployments where that subtree is world-writable.

What is the operational impact of successful exploitation?

Successful exploitation can crash ZooKeeper's critical request-processing thread and make the on-disk data directory permanently unbootable. This is an availability impact rather than a confidentiality or integrity impact.

What should be done if an immediate upgrade is not possible?

Restrict write access to the /zookeeper/quota subtree so that unauthenticated or otherwise untrusted users cannot write there. Upgrade affected ZooKeeper installations to 3.8.8 or 3.9.7 when possible.

Which ZooKeeper versions require remediation?

Apache ZooKeeper versions up to and including 3.9.6 are affected. The provided fixes are ZooKeeper 3.8.8 and 3.9.7.

UBUNTU-CVE-2026-100300: High severity ubuntu/zookeeper vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed without authentication?

What access does an attacker need to exploit this issue?

What is the operational impact of successful exploitation?

What should be done if an immediate upgrade is not possible?

Which ZooKeeper versions require remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed without authentication?

What access does an attacker need to exploit this issue?

What is the operational impact of successful exploitation?

What should be done if an immediate upgrade is not possible?

Which ZooKeeper versions require remediation?