# CVE-2026-100300: Apache ZooKeeper quota subsystem denial of service

Source: https://junglewise.ai/threats/cve-2026-100300-improper-handling-of-exceptional-conditions-in-the-quota  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-100300 · Severity: info · Published 2026-11-04

Apache ZooKeeper is a distributed coordination service used to manage configuration and synchronization across clustered systems. An unauthenticated attacker can crash the server's main request-processing thread and permanently corrupt the on-disk data directory by writing malformed quota configuration entries, rendering the service unable to restart.

Technologies: [Apache Zookeeper](https://junglewise.ai/threats/technologies/zookeeper). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-100300 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-100300 being exploited in the wild.

**How severe is CVE-2026-100300?** Informational severity, published 4 November 2026.

**Which products and versions are affected?** Apache Zookeeper up to 3.9.6.

**Is there a fix for CVE-2026-100300?** Yes: fixed in ZooKeeper 3.8.8, 3.9.7. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-100300 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-100300?** Check whether you run Apache Zookeeper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in ZooKeeper 3.8.8, 3.9.7

## Technical details

Improper exception handling in ZooKeeper's quota subsystem allows an attacker with write access to the /zookeeper/quota subtree to trigger a crash in the request-processing thread. On default deployments where this subtree is world-writable, this requires no authentication. The crash results in permanent corruption of the data directory, preventing the server from booting.

## Affected products

- Apache ZooKeeper up to 3.9.6

## Timeline

- 2026-11-04: disclosed

## References

- [https://repo.maven.apache.org/maven2](https://repo.maven.apache.org/maven2)
- [https://lists.apache.org/thread.html/09pgg7rcpzz44noxgtvpzstwt8fmvsb0](https://lists.apache.org/thread.html/09pgg7rcpzz44noxgtvpzstwt8fmvsb0)

## Related threats

- [Apache ZooKeeper uncontrolled recursion in snapshot serialization](https://junglewise.ai/threats/cve-2026-115448-uncontrolled-recursion-in-apache-zookeeper-the-server-serializes)
- [Apache ZooKeeper denial of service in multiRead handler](https://junglewise.ai/threats/cve-2026-100302-allocation-of-resources-without-limits-or-throttling-in-the)
- [Apache ZooKeeper improper authorization in SASL authentication](https://junglewise.ai/threats/cve-2026-100252-improper-authorization-vulnerability-in-apache-zookeeper-when)
- [Apache ZooKeeper setACL time-of-check time-of-use race condition](https://junglewise.ai/threats/cve-2026-100235-incorrect-authorization-due-to-a-time-of-check-to-time-of-use)
- [Apache ZooKeeper log injection via crafted add_auth request](https://junglewise.ai/threats/cve-2026-84501-apache-zookeeper-log-injection-via-crafted-add-auth-request)