GHSA-95q3-pppp-r683HighCVSS 7.5

Crash when decoding malformed HTTP requests or malformed JSON payload

Published
May 14, 2022
Last Modified
January 30, 2023

🔗 CVE IDs covered (1)

CVE-2018-1330 →

📋 Description

When parsing a malformed JSON payload, libprocess in Apache Mesos versions 1.4.0 to 1.5.0 might crash due to an uncaught exception. Parsing chunked HTTP requests with trailers can lead to a libprocess crash too because of the mistakenly planted assertion. A malicious actor can therefore cause a denial of service of Mesos masters rendering the Mesos-controlled cluster inoperable.

🎯 Affected products1

  • maven/org.apache.mesos:mesos:>= 1.4.0, < 1.6.0

🔗 References (3)