CVE-2017-7687

High

Published: 29/09/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Due to improper handling of a malformed URL in an HTTP request, libprocess in Apache Mesos before 1.1.3, 1.2.x before 1.2.2, 1.3.x before 1.3.1, and 1.4.0-dev may crash. A malicious actor can cause a denial of service of Mesos, rendering the Mesos-controlled cluster inoperable.

Risk Assessment

This vulnerability can lead to denial of service, affecting the availability of critical resources in the organization's IT infrastructure.

Recommendation

It is recommended to update Apache Mesos to the latest version to mitigate this vulnerability and to monitor logs for potential attack attempts.

Other vulnerabilities in Apache Mesos

CVE-2017-9790High
In Apache Mesos before 1.1.3, 1.2.x before 1.2.2, 1.3.x before 1.3.1, and 1.4.0-dev, libprocess crashes when handling a libprocess message wrapped in an HTTP request if the request path is empty. The parser assumes the request path always starts with '/'.

Original NVD description (English source)

When handling a decoding failure for a malformed URL path of an HTTP request, libprocess in Apache Mesos before 1.1.3, 1.2.x before 1.2.2, 1.3.x before 1.3.1, and 1.4.0-dev might crash because the code accidentally calls inappropriate function. A malicious actor can therefore cause a denial of service of Mesos masters rendering the Mesos-controlled cluster inoperable.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS