# CVE-2026-100300

ZooKeeper quota bug allows unauthenticated writes to crash servers and corrupt on-disk data.

- Page: https://www.vulneraibility.com/cve/CVE-2026-100300
- CVSS: 8.7
- Known exploited: not in CISA KEV as of our last sync
- CISA SSVC: exploitation none, automatable yes, technical impact partial (assessed 2026-11-04)
- Weakness: CWE-755
- Published: 2026-11-04

## Affected versions

- Apache Software Foundation Apache ZooKeeper: affected >= 3.9.0 and <= 3.9.6; >= 3.8.0 and <= 3.8.7

A version outside these ranges is not a statement that it is unaffected.

## Impact

Unauthenticated writer to /zookeeper/quota can crash request-processing thread and render data directory permanently unbootable — service outage and possible data loss.

## Action

Immediate action required

## Recommendation

Upgrade to 3.8.8 or 3.9.7 and tighten ACLs on /zookeeper/quota; restore from backups if needed.

## References

- [advisory] https://lists.apache.org/thread.html/09pgg7rcpzz44noxgtvpzstwt8fmvsb0
- [other] http://www.openwall.com/lists/oss-security/2026/11/03/11

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.