CVE-2018-11793

Vulnerability

A stack overflow vulnerability exists in the JSON parser of Apache Mesos versions before 1.4.3, 1.5.2, 1.6.2, and 1.7.0 (specifically all versions prior to 1.4.x, 1.4.0 through 1.4.2, 1.5.0 through 1.5.1, 1.6.0 through 1.6.1, and 1.7.0). The flaw is triggered when the parser processes a JSON payload containing deeply nested structures, causing unbounded recursion that overflows the call stack [1][2].

Exploitation

An attacker does not require authentication or special privileges; the vulnerability can be exploited remotely by sending a crafted JSON message to a Mesos master. No user interaction is needed beyond the master receiving the payload. The attack consists of delivering a JSON request with excessive nesting depth, which the parser attempts to recursively process until the stack overflows [1][2].

Impact

Successful exploitation causes a denial of service (DoS) of Mesos masters, rendering the entire Mesos-controlled cluster inoperable. The impact is limited to availability; there is no indication of confidentiality or integrity compromise [1][2].

Mitigation

Apache Mesos has released patched versions: 1.4.3, 1.5.2, 1.6.2, and 1.7.1. Users should upgrade to these or later versions immediately. No workarounds are described in the available references, and no listed CVE in KEV is present [2].