CVE-2017-9790

HIGH

Apache Mesos <1.1.3, 1.2.x <1.2.2, 1.3.x <1.3.1, 1.4.0-dev - DoS

Title source: llm
STIX 2.1

Description

When handling a libprocess message wrapped in an HTTP request, libprocess in Apache Mesos before 1.1.3, 1.2.x before 1.2.2, 1.3.x before 1.3.1, and 1.4.0-dev crashes if the request path is empty, because the parser assumes the request path always starts with '/'. A malicious actor can therefore cause a denial of service of Mesos masters rendering the Mesos-controlled cluster inoperable.

References (2)

Core 2
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/101023

Scores

CVSS v3 7.5
EPSS 0.0214
EPSS Percentile 84.4%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-416
Status published
Products (11)
apache/mesos 1.2.0
apache/mesos 1.2.1
apache/mesos 1.3.0
apache/mesos 1.3.1
apache/mesos 1.4.0-dev
apache/mesos < 1.1.2
Apache Software Foundation/Apache Mesos 1.2.x before 1.2.2
Apache Software Foundation/Apache Mesos 1.3.x before 1.3.1
Apache Software Foundation/Apache Mesos 1.4.0-dev
Apache Software Foundation/Apache Mesos versions prior to 1.1.3
... and 1 more
Published Sep 29, 2017
Tracked Since Feb 18, 2026