Read the docs
TI-2018-08449 Aliases CVE-2018-11793GHSA-p2xq-vcm7-xjj6

Memory corruption in Apache Mesos

Priority MEDIUM 41CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-119 and the CVSS impact.

Summary

When parsing a JSON payload with deeply nested JSON structures, the parser in Apache Mesos versions pre-1.4.x, 1.4.0 to 1.4.2, 1.5.0 to 1.5.1, 1.6.0 to 1.6.1, and 1.7.0 might overflow the stack due to unbounded recursion. A malicious actor can therefore cause a denial of service of Mesos masters rendering the Mesos-controlled cluster inoperable.

Why it matters now

EPSS 0.0497 92nd percentileScored 2026-11-07
Fix Fixed org.apache.mesos:mesos (Maven): 1.4.3, 1.5.2, 1.6.2 +1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache MesosApache Mesos pre-1.4.x, 1.4.0 to 1.4.2, 1.5.0 to 1.5.1, 1.6.0 to 1.6.1, 1.7.0—No fix listedCNA
—org.apache.mesos:mesos (Maven)before 1.4.31.4.3Patch availableGHSA-p2xq-vcm7-xjj6
—org.apache.mesos:mesos (Maven)1.5.0 to before 1.5.21.5.2Patch availableGHSA-p2xq-vcm7-xjj6
—org.apache.mesos:mesos (Maven)1.6.0 to before 1.6.21.6.2Patch availableGHSA-p2xq-vcm7-xjj6
—org.apache.mesos:mesos (Maven)1.7.0 to before 1.7.11.7.1Patch availableGHSA-p2xq-vcm7-xjj6
  • Apache Mesos VendorApache Affected Apache Mesos pre-1.4.x, 1.4.0 to 1.4.2, 1.5.0 to 1.5.1, 1.6.0 to 1.6.1, 1.7.0 Fixed in — No fix listed CNA
  • org.apache.mesos:mesos (Maven) Vendor— Affected before 1.4.3 Fixed in 1.4.3 Patch available GHSA-p2xq-vcm7-xjj6
  • org.apache.mesos:mesos (Maven) Vendor— Affected 1.5.0 to before 1.5.2 Fixed in 1.5.2 Patch available GHSA-p2xq-vcm7-xjj6
  • org.apache.mesos:mesos (Maven) Vendor— Affected 1.6.0 to before 1.6.2 Fixed in 1.6.2 Patch available GHSA-p2xq-vcm7-xjj6
  • org.apache.mesos:mesos (Maven) Vendor— Affected 1.7.0 to before 1.7.1 Fixed in 1.7.1 Patch available GHSA-p2xq-vcm7-xjj6

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:a:apache:mesos:*:*:*:*:*:*:*:*1.4.0 to before 1.4.3; 1.5.0 to before 1.5.2; 1.6.0 to before 1.6.2; 1.7.0 to before 1.7.1VulnerableApache
cpe:2.3:a:apache:mesos:1.4.0:rc1:*:*:*:*:*:*1.4.0 rc1VulnerableApache
cpe:2.3:a:apache:mesos:1.4.0:rc2:*:*:*:*:*:*1.4.0 rc2VulnerableApache
cpe:2.3:a:apache:mesos:1.4.0:rc3:*:*:*:*:*:*1.4.0 rc3VulnerableApache
cpe:2.3:a:apache:mesos:1.4.0:rc4:*:*:*:*:*:*1.4.0 rc4VulnerableApache
cpe:2.3:a:apache:mesos:1.4.0:rc5:*:*:*:*:*:*1.4.0 rc5VulnerableApache
cpe:2.3:a:apache:mesos:1.8.0:dev:*:*:*:*:*:*1.8.0 devVulnerableApache
  • cpe:2.3:a:apache:mesos:*:*:*:*:*:*:*:* Versions 1.4.0 to before 1.4.3; 1.5.0 to before 1.5.2; 1.6.0 to before 1.6.2; 1.7.0 to before 1.7.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:mesos:1.4.0:rc1:*:*:*:*:*:* Versions 1.4.0 rc1 Vulnerable ·Apache
  • cpe:2.3:a:apache:mesos:1.4.0:rc2:*:*:*:*:*:* Versions 1.4.0 rc2 Vulnerable ·Apache
  • cpe:2.3:a:apache:mesos:1.4.0:rc3:*:*:*:*:*:* Versions 1.4.0 rc3 Vulnerable ·Apache
  • cpe:2.3:a:apache:mesos:1.4.0:rc4:*:*:*:*:*:* Versions 1.4.0 rc4 Vulnerable ·Apache
  • cpe:2.3:a:apache:mesos:1.4.0:rc5:*:*:*:*:*:* Versions 1.4.0 rc5 Vulnerable ·Apache
  • cpe:2.3:a:apache:mesos:1.8.0:dev:*:*:*:*:*:* Versions 1.8.0 dev Vulnerable ·Apache

Remediation

  • Fix · GHSA-p2xq-vcm7-xjj6 org.apache.mesos:mesos (Maven) Fixed in 1.4.3 Advisory →
  • Fix · GHSA-p2xq-vcm7-xjj6 org.apache.mesos:mesos (Maven) Fixed in 1.5.2 Advisory →
  • Fix · GHSA-p2xq-vcm7-xjj6 org.apache.mesos:mesos (Maven) Fixed in 1.6.2 Advisory →
  • Fix · GHSA-p2xq-vcm7-xjj6 org.apache.mesos:mesos (Maven) Fixed in 1.7.1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat Fuse 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-11793
  2. 2026-10-03 Alias added: GHSA-p2xq-vcm7-xjj6

References

Advisory 2

Other 2

  • TI-2019-04061 runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows… CVSS 3.1HIGH 8.6
  • TI-2019-00180 A specifically crafted Docker image running under the root user can overwrite the init… CVSS 3.1HIGH 7.8
  • TI-2018-01231 Improper input validation in Apache Mesos CVSS 3.0HIGH 7.5
  • TI-2017-07170 Use after free in Apache Mesos CVSS 3.0HIGH 7.5
  • TI-2017-05323 When handling a decoding failure for a malformed URL path of an HTTP request, libprocess… CVSS 3.0HIGH 7.5
  • TI-2018-15893 An improper authorization vulnerability exists in Jenkins Mesos Plugin 0.17.1 and earlier… CVSS 3.0MEDIUM 6.5
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences