A client permitted to create znodes can trigger it. The default root ACL is open, so unauthenticated clients may be able to create the nested znode chain unless ACLs or authentication restrict creation.
The nested znode chain can remain within jute.maxbuffer limits. The failure is caused by one serialization stack frame per znode level and the absence of a depth bound, rather than oversized individual data.
The denial of service can persist across restart because the server rebuilds the deep tree from its transaction log and can fail again while taking the startup snapshot. Recovery can entail data loss, and the same log can affect both the leader and followers in an ensemble.
Use ACLs and authentication to restrict znode creation instead of relying on the default open root ACL. The recommended fixed releases are ZooKeeper 3.8.8 and 3.9.7.