CVE-2018-1330

Crash when decoding malformed HTTP requests or malformed JSON payload

7.5 HighFix available

When parsing a malformed JSON payload, libprocess in Apache Mesos versions 1.4.0 to 1.5.0 might crash due to an uncaught exception. Parsing chunked HTTP requests with trailers can lead to a libprocess crash too because of the mistakenly planted assertion. A malicious actor can therefore cause a denial of service of Mesos masters rendering the Mesos-controlled cluster inoperable.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

3.74%Up 2.2 points since Apr 14, 2021

What each source reports

NVD Score used 7.5

Record: CVE-2018-1330
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness: CWE-20
Updated: 2026-11-02

CVE List No score

Record: CVE-2018-1330
Updated: 2026-11-02

EUVDEUVD-2022-3293 No score

Record: EUVD-2022-3293
Updated: 2026-11-03

GitHub AdvisoriesGHSA-95q3-pppp-r683 7.5

Crash when decoding malformed HTTP requests or malformed JSON payload

Record: GHSA-95q3-pppp-r683
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-248
Updated: 2026-11-02

OSV 7.5

Record: CVE-2018-1330
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVGHSA-95q3-pppp-r683 7.5

Crash when decoding malformed HTTP requests or malformed JSON payload

Record: GHSA-95q3-pppp-r683
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-248
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.apache.mesos:mesos` Maven	1.4.0 up to 1.6.0	1.6.0
`org.apache.mesos:mesos` Maven	1.4.0 up to 1.6.0, plus listed versions 1.4.11.4.21.4.31.5.01.5.21.5.3	1.6.0

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, products	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-1330 is a high vulnerability (CVSS 7.5) in Apache Mesos, published September 13, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.74%, the 89th percentile. Fixed in org.apache.mesos:mesos 1.6.0.