DEBIAN-CVE-2026-100302

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-100302
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-100302.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-100302
Upstream
  • CVE-2026-100302
Published
2026-11-04T11:17:07Z
Modified
2026-11-06T15:01:04Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
Summary
[none]
Details

Allocation of Resources Without Limits or Throttling in the multiRead request handler of Apache ZooKeeper allows a remote attacker to crash the server (denial of service) with a single small request. The multiRead handler places no limit on the number of bundled read operations or on the cumulative size of the response it builds in memory. Because each operation's result is fully materialized and retained before serialization, a request that is small on the wire — within the jute.maxbuffer limit — but that references a large znode many times can force the server to allocate far more heap than the request size implies, exhausting the JVM heap and terminating the server with an OutOfMemoryError. Neither jute.maxbuffer nor largeRequestMaxBytes prevents this, as both bound only the inbound request, not the response. This issue affects Apache ZooKeeper from 3.7.0 through 3.9.6. Users are recommended to upgrade to version 3.9.7, which enforces configurable limits on the multiRead operation count and cumulative response size.

References

Affected packages

Debian:12 / zookeeper

Package

Name
zookeeper
Purl
pkg:deb/debian/zookeeper?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.8.0-11
3.8.0-11+deb12u1
3.8.0-11+deb12u2
3.9.1-1
3.9.2-1
3.9.2-2
3.9.3-1
3.9.3-2
3.9.4-1
3.9.4-2
3.9.5-1
3.9.5-2
3.9.6-1
3.9.6-2
3.9.6-3

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-100302.json"

Debian:13 / zookeeper

Package

Name
zookeeper
Purl
pkg:deb/debian/zookeeper?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.9.3-1
3.9.3-1+deb13u1
3.9.3-2
3.9.4-1
3.9.4-2
3.9.5-1
3.9.5-2
3.9.6-1
3.9.6-2
3.9.6-3

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-100302.json"

Debian:14 / zookeeper

Package

Name
zookeeper
Purl
pkg:deb/debian/zookeeper?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.9.3-1
3.9.3-2
3.9.4-1
3.9.4-2
3.9.5-1
3.9.5-2
3.9.6-1
3.9.6-2
3.9.6-3

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-100302.json"