Detections
Analytics

Apache ZooKeeper 3.7.0 - 3.8.7 / 3.9.x < 3.9.7 DoS (CVE-2026-100302)

high Nessus Plugin ID 377014

Synopsis

The remote Apache ZooKeeper server is affected by a denial of service vulnerability.

Description

The version of Apache ZooKeeper listening on the remote host is 3.7.0 through 3.8.7 or 3.9.x prior to 3.9.7. It is, therefore, affected by a denial of service vulnerability:

 - Allocation of Resources Without Limits or Throttling in the multiRead request handler of Apache ZooKeeper allows a remote attacker to crash the server (denial of service) with a single small request. The multiRead handler places no limit on the number of bundled read operations or on the cumulative size of the response it builds in memory. Because each operation's result is fully materialized and retained before serialization, a request that is small on the wire - within the jute.maxbuffer limit - but that references a large znode many times can force the server to allocate far more heap than the request size implies, exhausting the JVM heap and terminating the server with an OutOfMemoryError. Neither jute.maxbuffer nor largeRequestMaxBytes prevents this, as both bound only the inbound request, not the response.
 (CVE-2026-100302)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update to Apache ZooKeeper 3.9.7 or later.

See Also

https://www.openwall.com/lists/oss-security/2026/11/03/12

Plugin Details

Severity: High

ID: 377014

File Name: apache_zookeeper_cve-2026-100302.nasl

Version: 1.2

Type: Combined

Family: Misc.

Published: 11/6/2026

Updated: 11/6/2026

Configuration: Enable thorough checks (optional)

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.83

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2026-100302

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVSS v4

Risk Factor: High

Base Score: 7.1

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

CPE: cpe:/a:apache:zookeeper

Required KB Items: installed_sw/Apache Zookeeper

Patch Publication Date: 11/3/2026

Vulnerability Publication Date: 11/3/2026

Reference Information

CVE: CVE-2026-100302

IAVB: 2026-B-0312