https://seclists.org/oss-sec/2026/q4/486: CVE-2026-100300: Apache ZooKeeper: Unauthenticated persistent denial of service via unvalidated quota-node data and paths crashing the transaction-apply thread

Q: Are default ZooKeeper deployments exposed without authentication?

Yes. On default deployments, the /zookeeper/quota subtree is world-writable, so an unauthenticated attacker can write there and trigger the issue.

Q: What access does an attacker need to exploit this vulnerability?

The attacker needs the ability to write under /zookeeper/quota. No authentication is required where the default world-writable permissions are in use.

Q: What is the operational impact if exploitation succeeds?

Exploitation can crash ZooKeeper's critical request-processing thread and cause denial of service. It can also leave the on-disk data directory permanently unbootable.

Q: Which versions contain the fix?

Upgrade to Apache ZooKeeper 3.8.8 or 3.9.7. The affected releases are 3.8.0 through 3.8.7 and 3.9.0 through 3.9.6.

Published Nov 3, 2026

Updated

Affected Software

1 affected component

Apache Zookeeper>=3.9.0<=3.9.6, >=3.8.0<=3.8.7

Frequently Asked Questions

Are default ZooKeeper deployments exposed without authentication?

Yes. On default deployments, the /zookeeper/quota subtree is world-writable, so an unauthenticated attacker can write there and trigger the issue.

What access does an attacker need to exploit this vulnerability?

The attacker needs the ability to write under /zookeeper/quota. No authentication is required where the default world-writable permissions are in use.

What is the operational impact if exploitation succeeds?

Exploitation can crash ZooKeeper's critical request-processing thread and cause denial of service. It can also leave the on-disk data directory permanently unbootable.

Which versions contain the fix?

Upgrade to Apache ZooKeeper 3.8.8 or 3.9.7. The affected releases are 3.8.0 through 3.8.7 and 3.9.0 through 3.9.6.

https://seclists.org/oss-sec/2026/q4/486: CVE-2026-100300: Apache ZooKeeper: Unauthenticated persistent denial of service via unvalidated quota-node data and paths crashing the transaction-apply thread

Affected Software

Frequently Asked Questions

Are default ZooKeeper deployments exposed without authentication?

What access does an attacker need to exploit this vulnerability?

What is the operational impact if exploitation succeeds?

Which versions contain the fix?

Company

Resources

Contact

Frequently Asked Questions

Are default ZooKeeper deployments exposed without authentication?

What access does an attacker need to exploit this vulnerability?

What is the operational impact if exploitation succeeds?

Which versions contain the fix?