GHSA-x869-784m-jmj2HighCVSS 7.5

Denial of service in Apache Mesos

Published
May 13, 2022
Last Modified
January 30, 2023

🔗 CVE IDs covered (1)

CVE-2017-7687 →

📋 Description

When handling a decoding failure for a malformed URL path of an HTTP request, libprocess in Apache Mesos might crash because the code accidentally calls inappropriate function. A malicious actor can therefore cause a denial of service of Mesos masters rendering the Mesos-controlled cluster inoperable.

🎯 Affected products3

  • maven/org.apache.mesos:mesos:< 1.1.3
  • maven/org.apache.mesos:mesos:>= 1.2.0, < 1.2.2
  • maven/org.apache.mesos:mesos:>= 1.3.0, < 1.3.1

🔗 References (4)