# CVE-2010-3198: Zope ZServer denial of service via worker thread crash

Source: https://junglewise.ai/threats/cve-2010-3198-zope-zserver-denial-of-service-via-worker-thread-crash  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-05-17. Updated: 2026-05-29  
License: CC BY 4.0 with a link back

CVE-2010-3198 · Severity: high · CVSS 7.5 · Published 2022-05-17

A vulnerability in the ZServer component of the Zope web application server allows remote attackers to crash the server's worker threads. By sending specifically crafted web requests that trigger unhandled errors, an attacker can exhaust the server's processing capacity. This results in a denial of service where the application remains running but becomes unresponsive to legitimate users.

Technologies: [Zope (PyPI)](https://junglewise.ai/threats/technologies/zope). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2010-3198 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2010-3198 being exploited in the wild.

**How severe is CVE-2010-3198?** High severity, with a CVSS score of 7.5, published 17 May 2022.

**Which products and versions are affected?** Zope (PyPI) ECOSYSTEM:introduced=2.10.0,fixed=2.10.12, ECOSYSTEM:introduced=2.10.0,fixed=2.10.12,introduced=2.11.0,fixed=2.11.7.

**Is there a fix for CVE-2010-3198?** Yes. Zope (PyPI): upgrade to 2.10.12, 2.11.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2010-3198 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2010-3198?** Check whether you run Zope (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Zope (PyPI): upgrade to 2.10.12, 2.11.7 or later

  ```sh
  pip install "Zope>=2.11.7"
  ```


## Technical details

The ZServer component in Zope versions 2.10.x (before 2.10.12) and 2.11.x (before 2.11.7) lacks a global exception handler for its worker threads. An unauthenticated remote attacker can exploit this by sending requests that trigger uncaught exceptions—for example, by providing malformed list parameters to certain authentication plugins like CookieAuthHelper. When an exception occurs during publication and is not caught, the individual worker thread terminates. By repeating this process, an attacker can kill all available worker threads, leading to a complete denial of service. The issue was resolved by backporting a catch-all exception handler from Zope 2.12.

## Affected products

- Zope Foundation Zope >= 2.10.0, < 2.10.12; >= 2.11.0, < 2.11.7

## Identifiers

- CVE-2010-3198
- GHSA-qh4q-fwf8-qqrw
- PYSEC-2010-32
- PYSEC-2010-33

## Timeline

- 2010-09-01: patched: Fixes committed to 2.10 and 2.11 branches and releases announced.
- 2010-09-08: advisory: NVD published CVE-2010-3198.
- 2022-05-17: advisory: GitHub Advisory published.

## References

- [https://bugs.launchpad.net/zope2/+bug/627988](https://bugs.launchpad.net/zope2/+bug/627988)
- [https://mail.zope.org/pipermail/zope-announce/2010-September/002247.html](https://mail.zope.org/pipermail/zope-announce/2010-September/002247.html)
- [http://www.zope.org/Products/Zope/2.10.12/CHANGES.txt](http://www.zope.org/Products/Zope/2.10.12/CHANGES.txt)
- [http://www.zope.org/Products/Zope/2.11.7/CHANGES.txt](http://www.zope.org/Products/Zope/2.11.7/CHANGES.txt)
- [https://github.com/zopefoundation/Zope/commit/0f2f56f63e4a4d695ee670e02b317e900550dbac](https://github.com/zopefoundation/Zope/commit/0f2f56f63e4a4d695ee670e02b317e900550dbac)

## Related threats

- [PYSEC-2026-2326 - Access control vulnerable to user data deletion by anonynmous users](https://junglewise.ai/threats/cve-2024-51734-access-control-vulnerable-to-user-data-deletion-by-anonynmous)
- [PYSEC-2026-2325 - Information disclosure in AccessControl](https://junglewise.ai/threats/cve-2023-41050-information-disclosure-in-accesscontrol)
- [PYSEC-2026-2077 - Zope vulnerable to Stored Cross Site Scripting with SVG images](https://junglewise.ai/threats/cve-2023-42458-zope-vulnerable-to-stored-cross-site-scripting-with-svg-images)
- [PYSEC-2026-760 - Zope DocumentTemplate package allows unauthenticated write](https://junglewise.ai/threats/cve-2000-0483-zope-documenttemplate-package-allows-unauthenticated-write)
- [PYSEC-2026-761 - Zope Server vulnerable to DoS via header injection](https://junglewise.ai/threats/cve-2002-0687-zope-server-vulnerable-to-dos-via-header-injection)