What’s Vulnerable › Vulnerabilities
CVE-2017-9790
- Severity: high (CVSS 7.5 v3.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 2.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2017-09-29 · updated 2026-06-17
- Weakness: CWE-416
Description
When handling a libprocess message wrapped in an HTTP request, libprocess in Apache Mesos before 1.1.3, 1.2.x before 1.2.2, 1.3.x before 1.3.1, and 1.4.0-dev crashes if the request path is empty, because the parser assumes the request path always starts with '/'. A malicious actor can therefore cause a denial of service of Mesos masters rendering the Mesos-controlled cluster inoperable.
Affected products
- Apache Software Foundation Apache Mesos: through 1.1.2; 1.2.0, 1.2.1, 1.3.0, 1.3.1, 1.4.0-dev
References
- http://www.securityfocus.com/bid/101023
- https://lists.apache.org/thread.html/cc1e7a69ea78da0511f5b54b6be7aa6e3c78edad5aaff430e7de028b%40%3Cdev.mesos.apache.org%3E
- http://www.securityfocus.com/bid/101023
- https://lists.apache.org/thread.html/cc1e7a69ea78da0511f5b54b6be7aa6e3c78edad5aaff430e7de028b%40%3Cdev.mesos.apache.org%3E
Get alerted when CVE-2017-9790 or the next vulnerability affects your stack