CVE-2017-9790
- Source
- https://cve.org/CVERecord?id=CVE-2017-9790
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-9790.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2017-9790
- Aliases
- Published
- 2017-09-29T01:34:50.640Z
- Modified
- 2026-02-11T10:02:03.128359Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
When handling a libprocess message wrapped in an HTTP request, libprocess in Apache Mesos before 1.1.3, 1.2.x before 1.2.2, 1.3.x before 1.3.1, and 1.4.0-dev crashes if the request path is empty, because the parser assumes the request path always starts with '/'. A malicious actor can therefore cause a denial of service of Mesos masters rendering the Mesos-controlled cluster inoperable.
- References