Description
Allocation of Resources Without Limits or Throttling in the multiRead request handler of Apache ZooKeeper allows a remote attacker to crash the server (denial of service) with a single small request.

The multiRead handler places no limit on the number of bundled read operations or on the cumulative size of the response it builds in memory. Because each operation's result is fully materialized and retained before serialization, a request that is small on the wire — within the jute.maxbuffer limit — but that references a large znode many times can force the server to allocate far more heap than the request size implies, exhausting the JVM heap and terminating the server with an OutOfMemoryError. Neither jute.maxbuffer nor largeRequestMaxBytes prevents this, as both bound only the inbound request, not the response.

This issue affects Apache ZooKeeper from 3.7.0 through 3.9.6. Users are recommended to upgrade to version 3.9.7, which enforces configurable limits on the multiRead operation count and cumulative response size.
Published: 2026-11-04
Score: 7.1 High
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

A request to ZooKeeper’s multiRead operation can create a request that is small on the wire yet forces the server to allocate an unbounded amount of memory for its response. Because each read is fully materialized before serialization, a single request can exhaust the JVM heap and cause a crash. This results in a denial of service, interrupting ZooKeeper’s availability to all clients. The weakness is a classic example of resource exhaustion (CWE-770).

Affected Systems

Apache ZooKeeper releases 3.7.0 through 3.9.6 are vulnerable. The affected component is the multiRead request handler, and any ZooKeeper server that accepts traffic from beyond its own cluster can be targeted.

Risk and Exploitability

The CVSS score of 7.1 indicates a high impact, and the EPSS score is not available, but the lack of limits means remote attackers can craft a specially constructed multiRead request over the network to trigger an OutOfMemoryError. The vulnerability is not listed in the CISA KEV catalog. Because the attack requires only network access to a ZooKeeper server, the likelihood of exploitation in the wild is elevated for exposed instances.

Generated by OpenCVE AI on November 4, 2026 at 12:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Apache ZooKeeper to version 3.9.7 or later, which enforces configurable limits on the multiRead operation count and cumulative response size.
  • Configure jute.maxbuffer and largeRequestMaxBytes to more restrictive values to limit inbound request size, mitigating trivial abuse even though they do not bound the response size.
  • Monitor JVM heap usage and configure automated restarting or scaling of ZooKeeper nodes to restore service after an OutOfMemoryError, minimizing the duration of denial of service.

Generated by OpenCVE AI on November 4, 2026 at 12:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 04 Nov 2026 13:00:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache zookeeper
Vendors & Products Apache
Apache zookeeper

Wed, 04 Nov 2026 12:30:00 +0000

Type Values Removed Values Added
References

Wed, 04 Nov 2026 11:00:00 +0000

Type Values Removed Values Added
Description Allocation of Resources Without Limits or Throttling in the multiRead request handler of Apache ZooKeeper allows a remote attacker to crash the server (denial of service) with a single small request. The multiRead handler places no limit on the number of bundled read operations or on the cumulative size of the response it builds in memory. Because each operation's result is fully materialized and retained before serialization, a request that is small on the wire — within the jute.maxbuffer limit — but that references a large znode many times can force the server to allocate far more heap than the request size implies, exhausting the JVM heap and terminating the server with an OutOfMemoryError. Neither jute.maxbuffer nor largeRequestMaxBytes prevents this, as both bound only the inbound request, not the response. This issue affects Apache ZooKeeper from 3.7.0 through 3.9.6. Users are recommended to upgrade to version 3.9.7, which enforces configurable limits on the multiRead operation count and cumulative response size.
Title Apache ZooKeeper: Denial of service through unbounded memory allocation in multiRead request handling
Weaknesses CWE-770
References
Metrics cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Apache Zookeeper
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-11-04T15:18:55.017Z

Reserved: 2026-09-25T17:59:47.459Z

Link: CVE-2026-100302

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-11-04T11:17:07.023

Modified: 2026-11-04T14:10:09.713

Link: CVE-2026-100302

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-04T12:45:13Z

Weaknesses
  • CWE-770

    Allocation of Resources Without Limits or Throttling