cyfenced.com →

[ CVE-2026-100300 · Published 4 Nov 2026 ]

Vulnerability in Apache Software Foundation Apache ZooKeeper

CVSS 8.7 1 agency advisoryFix available

[ Description ]Official description

Improper handling of exceptional conditions in the quota subsystem of Apache ZooKeeper allows an attacker able to write under the /zookeeper/quota subtree — unauthenticated on default deployments, where that subtree is world-writable — to crash the server's critical request-processing thread and render the on-disk data directory permanently unbootable. This issue affects Apache ZooKeeper up to and including 3.9.6. Users are recommended to upgrade to version 3.8.8 or 3.9.7, which fixes the issue.

[ Fixes ]Fixes and patches

[ Advisories ]Government CERT advisories

  • CERT-FRCERTFR-2026-AVI-1448

    Multiple vulnerabilities in Apache Zookeeper Translated from French

    Multiple vulnerabilities have been discovered in Apache Zookeeper. They allow an attacker to cause remote denial of service and a security policy bypass.

    CVE-2026-100302CVE-2026-115448CVE-2026-100235+2 more CVEs

[ References ]References