CVE-2026-100302

Ranges per package from the CVE rows that match this port, in pkg notation with the port's epoch and revision, every bound checked with pkg; one range per epoch the port actually had. make newentry in security/vuxml creates the vid.

Copy to clipboard

  <vuln vid="FIXME (make newentry)">
    <topic>libzookeeper -- FIXME</topic>
    <affects>
      <package>
	<name>libzookeeper</name>
	<name>zookeeper</name>
	<range><ge>3.8.0</ge><le>3.8.7</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>CVE-2026-100302: Allocation of Resources Without Limits or Throttling
	  in the multiRead request handler of Apache ZooKeeper allows a
	  remote attacker to crash the server (denial of service) with a
	  single small request. The multiRead handler places no limit on the
	  number of bundled read operations or on the cumulative size of the
	  response it builds in memory. Because each operation's result is
	  fully materialized and retained before serialization, a request
	  that is small on the wire — within the jute.maxbuffer limit — but
	  that references a large znode many times can force the server to
	  allocate far more heap than the request size implies, exhausting
	  the JVM heap and terminating the server with an OutOfMemoryError.
	  Neither jute.maxbuffer nor largeRequestMaxBytes prevents this, as
	  both bound only the inbound request, not the response. This issue
	  affects Apache ZooKeeper from 3.7.0 through 3.9.6. Users are
	  recommended to upgrade to version 3.9.7, which enforces
	  configurable limits on the multiRead operation count and cumulative
	  response size.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-100302</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-100302</url>
    </references>
    <dates>
      <discovery>2026-11-04</discovery>
      <entry>2026-11-04</entry>
    </dates>
  </vuln>