{"id":"EM-20261104-81IP","url":"https://cyber.eventmonitor.net/incident/EM-20261104-81IP/","type":"cve","title":"multiRead Vulnerability (CVE-2026-100302)","subtitle":"CVE-2026-100302","subject":"CVE-2026-100302","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-11-04T11:17:07.023Z","firstSignal":"2026-11-04T10:46:20.000Z","lastSignal":"2026-11-04T11:17:07.023Z","updated":"2026-11-05T01:06:50.406Z","revision":1,"life":[{"status":"Born","at":"2026-11-04T11:17:07.023Z","why":"second independent source: C6 NVD CVE API 2.0"},{"status":"Developing","at":"2026-11-04T11:17:07.023Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-04T10:46:20.000Z","what":"First signal: C41 Red Hat Security Data"},{"at":"2026-11-04T11:17:07.023Z","what":"Born: second source, C6 NVD CVE API 2.0. Page EM-20261104-81IP created."},{"at":"2026-11-04T11:17:07.023Z","what":"Severity raised to High by C6"}],"stages":[{"name":"Disclosed","at":"2026-11-04T11:17:07.023Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-04T11:17:07.023Z","detail":"CVSS 7.1"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":"2026-11-04T10:46:20.000Z","detail":"C41 published"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-04T10:46:20.000Z","source":"C41","sourceName":"Red Hat Security Data","role":"Vendor","severity":2,"title":"Red Hat: CVE-2026-100302 (moderate)","text":"org.apache.zookeeper/zookeeper: Apache ZooKeeper: Denial of Service via unbounded multiRead response memory allocation","url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-100302.json"},{"at":"2026-11-04T11:17:07.023Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":3,"title":"CVE-2026-100302 (CVSS 7.1)","text":"Allocation of Resources Without Limits or Throttling in the multiRead request handler of Apache ZooKeeper allows a remote attacker to crash the server (denial of service) with a single small request.\n\nThe multiRead handler places no limit on the number of bundled read operations or on the cumulative size of the response it builds in memory. Because each operation's result is fully materialized and retained before serialization, a request that is small on the wire — within the jute.maxbuffer limit — but that references a large znode many times can force the server to allocate far more heap than","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100302"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-04T11:17:07.023","score":7.1,"severity":"HIGH","desc":"Allocation of Resources Without Limits or Throttling in the multiRead request handler of Apache ZooKeeper allows a remote attacker to crash the server (denial of service) with a single small request.\n\nThe multiRead handler places no limit on the number of bundled read operations or on the cumulative","product":"","seen":1793817148789},"kev":null,"epss":null,"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}