CVE-2026-100302
Description
A flaw was found in Apache ZooKeeper. An authenticated remote attacker can cause a Denial of Service (DoS) by submitting a request containing multiple bundled read operations for large data nodes. Because the multiRead handler does not restrict the cumulative response size generated in memory, the server exhausts available memory and terminates unexpectedly.
Statement
This vulnerability is rated Moderate because triggering the denial of service requires authenticated client access to query existing nodes, and the blast radius is confined to service availability without compromising data confidentiality or system integrity. In typical Red Hat deployments, Apache ZooKeeper is not exposed to untrusted public networks and operates within isolated cluster environments. While an authenticated client can trigger heap exhaustion leading to process termination, the condition does not permit arbitrary code execution or data leakage.
Mitigation
Restrict network access to the Apache ZooKeeper client port (default TCP 2181) to trusted internal hosts and cluster members using firewall controls.
1. Restrict port access using `firewalld`:
firewall-cmd --permanent --zone=trusted --add-source=<TRUSTED_HOST_IP>
firewall-cmd --permanent --remove-port=2181/tcp
firewall-cmd --reload
2. Caveats:
Limiting access to ZooKeeper prevents unlisted hosts and applications from reaching the ensemble. Ensure all legitimate cluster nodes, dependent services, and monitoring probes are permitted before applying the firewall policy.
Warning: Reloading the firewall configuration using `firewall-cmd --reload` applies modifications immediately and may drop or briefly disrupt active network connections. Verify all rules in advance.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.5 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
