Threats tagged 'ghsa-48x8-7x62-q6q9'

Apache ZooKeeper versions 3.7.0 through 3.9.6 contain a vulnerability in the multiRead request handler that allows remote attackers to cause a denial of service by crashing the server. The handler does not limit the number of bundled read operations or the cumulative size of the response, enabling memory exhaustion via a crafted request referencing a large znode multiple times. This leads to an OutOfMemoryError and server termination. Version 3.9.7 introduces configurable limits to mitigate this issue.