{"metadata": {"vulnerability": "CVE-2026-100302", "count": 22, "kinds": {"milestone": 6, "sighting": 4, "kev": 0, "other": 12}}, "data": [{"timestamp": "2026-09-25T17:59:47.459Z", "date_only": false, "value": "2026-09-25T17:59:47.459Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-100302", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-03T20:51:26.251Z", "date_only": false, "value": "2026-11-03T20:51:26.251228Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/dsttxk6nf77o2", "record": "CVE-2026-100302", "field": "creation_timestamp", "uuid": "e567de13-3ee7-4e46-b989-bd711a840a73", "content": "CVE-2026-100302: Apache ZooKeeper: Denial of service through unbounded memory allocation in multiRead request handling", "url": "https://bsky.app/profile/infosec.skyfleet.blue/post/dsttxk6nf77o2"}, {"timestamp": "2026-11-04T00:00:00Z", "date_only": false, "value": "2026-11-04T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1448", "record": "CERTFR-2026-AVI-1448", "field": "last_revision_date", "linked_record": true}, {"timestamp": "2026-11-04T00:00:00Z", "date_only": true, "value": "2026-11-04", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1448", "record": "CERTFR-2026-AVI-1448", "field": "initial_release_date", "linked_record": true, "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-04T00:00:00Z", "date_only": false, "value": "2026-11-04T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1448", "record": "CERTFR-2026-AVI-1448", "field": "revisions.0.revision_date", "linked_record": true}, {"timestamp": "2026-11-04T10:46:20.042Z", "date_only": false, "value": "2026-11-04T10:46:20.042Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-100302", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-04T10:46:20.042Z", "date_only": false, "value": "2026-11-04T10:46:20.042Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / apache", "record": "CVE-2026-100302", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-04T10:56:42.754Z", "date_only": false, "value": "2026-11-04T10:56:42.754547Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117557808479310755", "record": "CVE-2026-100302", "field": "creation_timestamp", "uuid": "1d296b6d-893c-4e8f-8e5f-9ace9b001f86", "content": "CVE-2026-100302 Apache ZooKeeper: Denial of service through unbounded memory allocation in multiRead request handling Allocation of Resources Without Limits or Throttling in the multiRead request handler of Apache ZooKeeper allows a remote attacker to crash the server (denial of service) with a single small request.\nThe multiRead handler places no limit on the number of bundled read operations or on the cumulative size of the response it builds in memory. Because each operation's result is fully materialized and retained before serialization, a request that is small on the wire \u2014 within the jute.maxbuffer limit \u2014 but that references a large znode many times can force the server to allocate far more heap than the request size implies, exhausting the JVM heap and terminating the server with an OutOfMemoryError. Neither jute.maxbuffer nor largeRequestMaxBytes prevents this, as both bound only the inbound request, not the response.\nThis issue affects Apache ZooKeeper from 3.7.0 through 3.9.6. Users are recommended to upgrade to version 3.9.7, which enforces configurable limits on the multiRead operation count and cumulative response size.\nhttps://www.cve.org/CVERecord?id=CVE-2026-100302https://lists.apache.org/thread.html/gj2vxwx8myq31js6tvb7bgls4nnxohj7#apache #ApacheSoftwareFoundation #ApacheZooKeeper#CVE_2026_100302#bot", "url": "https://infosec.exchange/users/cve/statuses/117557808479310755"}, {"timestamp": "2026-11-04T11:01:40.354Z", "date_only": false, "value": "2026-11-04T11:01:40.354435Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/suriq.io/post/3mzi7auu3wb2p", "record": "CVE-2026-100302", "field": "creation_timestamp", "uuid": "d827a539-772b-40f6-9e35-9fca428cb707", "content": "CVE-2026-100302: Apache ZooKeeper's multiRead request handler lets a remote attacker crash the server with one small request that exhausts memory. No exploitation is confirmed. The fix is version 3.9.7, which caps operation count and response size.", "url": "https://bsky.app/profile/suriq.io/post/3mzi7auu3wb2p"}, {"timestamp": "2026-11-04T11:09:44.818Z", "date_only": false, "value": "2026-11-04T11:09:44.818Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "CVE-2026-100302", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-04T11:17:07Z", "date_only": false, "value": "2026-11-04T11:17:07Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-48X8-7X62-Q6Q9", "record": "GHSA-48X8-7X62-Q6Q9", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-04T11:17:07.023Z", "date_only": false, "value": "2026-11-04T11:17:07.023", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-100302", "record": "FKIE_CVE-2026-100302", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-04T11:50:24.370Z", "date_only": false, "value": "2026-11-04T11:50:24.370186Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/f7j6ecz73ch6z", "record": "CVE-2026-100302", "field": "creation_timestamp", "uuid": "98fb018f-b140-495c-81c3-59c1ed42af9f", "content": "CVE-2026-100302 - Apache ZooKeeper: Denial of service through unbounded memory allocation in multiRead request handling\nCVE ID : CVE-2026-100302\n \n Published : Nov. 4, 2026, 10:46 a.m. | 18\u00a0minutes ago\n \n Description : Allocation of Resources Without Limits or Throttling in th...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/f7j6ecz73ch6z"}, {"timestamp": "2026-11-04T12:31:30Z", "date_only": false, "value": "2026-11-04T12:31:30Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-48X8-7X62-Q6Q9", "record": "GHSA-48X8-7X62-Q6Q9", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-04T12:31:30Z", "date_only": false, "value": "2026-11-04T12:31:30Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-48X8-7X62-Q6Q9", "record": "GHSA-48X8-7X62-Q6Q9", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-04T14:34:46.610Z", "date_only": false, "value": "2026-11-04T14:34:46.610023Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-100302", "field": "containers.adp.1.metrics.0.other.content.timestamp"}, {"timestamp": "2026-11-04T14:34:46.610Z", "date_only": false, "value": "2026-11-04T14:34:46.610023Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-100302", "record": "FKIE_CVE-2026-100302", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-11-04T15:18:55.017Z", "date_only": false, "value": "2026-11-04T15:18:55.017Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-100302", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-04T15:18:55.017Z", "date_only": false, "value": "2026-11-04T15:18:55.017Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-100302", "field": "containers.adp.1.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-04T16:17:31.093Z", "date_only": false, "value": "2026-11-04T16:17:31.093", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-100302", "record": "FKIE_CVE-2026-100302", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-05T00:00:00Z", "date_only": false, "value": "2026-11-05T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-100302", "record": "UBUNTU-CVE-2026-100302", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-05T00:00:00Z", "date_only": false, "value": "2026-11-05T00:00:00Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-100302", "record": "UBUNTU-CVE-2026-100302", "field": "modified", "linked_record": true}], "metrics": {"as_of": "2026-11-08T12:14:57.657Z", "anchors": {"origin": {"timestamp": "2026-11-04T00:00:00Z", "date_only": true, "value": "2026-11-04", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1448", "record": "CERTFR-2026-AVI-1448", "field": "initial_release_date", "linked_record": true, "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-04T00:00:00Z", "date_only": true, "value": "2026-11-04", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1448", "record": "CERTFR-2026-AVI-1448", "field": "initial_release_date", "linked_record": true, "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 389697.657895, "hours": 108.24934941527778, "days": 4.510389558969908, "min_seconds": 303297.657895, "max_seconds": 389697.657895, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-04T00:00:00Z", "date_only": true, "value": "2026-11-04", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1448", "record": "CERTFR-2026-AVI-1448", "field": "initial_release_date", "linked_record": true, "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-08T12:14:57.657Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}