Apache ZooKeeper serializes its data tree into a snapshot by recursively descending a stack frame for each znode level, but the implementation does not limit the depth of recursion. A client that can create znodes – which is permitted by the default open ACL on the root znode – can construct an arbitrarily deep chain of nested znodes. When the server attempts to take a snapshot, the unchecked recursion exhausts the JVM stack and terminates the snapshot thread. Because the corrupted transaction log is subsequently replayed on restart, the problem persists, causing the server to remain unavailable and potentially leading to data loss. This flaw is classified as a denial‑of‑service vulnerability stemming from uncontrolled resource consumption (CWE‑770).

The affected product is Apache ZooKeeper. Versions 3.8.0 through 3.8.7 and 3.9.0 through 3.9.6 contain the flaw. The vendor advises upgrading to 3.8.8 or 3.9.7, the first releases that include the fix. All ZooKeeper nodes in an ensemble that remain on older versions can be affected because the same transaction log is shared by leaders and followers.

A CVSS score of 8.7 indicates a high‑severity denial‑of‑service condition. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, suggesting no confirmed exploits in the wild. Nonetheless, a threat actor who can connect to the ZooKeeper service and create znodes can easily exploit the issue. The impact unfolds locally on the server that performs the snapshot and then propagates to other ensemble members when the log is replayed, making mitigation time‑critical.