ONOS versions 1.8.0, 1.9.0, and 1.10.0 do not restrict the amount of memory allocated.
Priority LOW 35CWE-770Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-770.
Summary
ONOS versions 1.8.0, 1.9.0, and 1.10.0 do not restrict the amount of memory allocated. The Netty payload size is not limited.
Why it matters now
EPSS 0.0106 64th percentileScored 2026-11-07
Fix Fixed org.onosproject:onos-base (Maven): 1.11.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.onosproject:onos-base (Maven) | 1.8.0 to before 1.11.0 | 1.11.0 | Patch available | GHSA-c6p7-vhw7-rc9w |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.onosproject:onos-base (Maven) Vendor— Affected 1.8.0 to before 1.11.0 Fixed in 1.11.0 Patch available GHSA-c6p7-vhw7-rc9w
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:onosproject:onos:1.8.0:*:*:*:*:*:*:* | 1.8.0 | Vulnerable | onosproject |
| cpe:2.3:a:onosproject:onos:1.9.0:*:*:*:*:*:*:* | 1.9.0 | Vulnerable | onosproject |
| cpe:2.3:a:onosproject:onos:1.10.0:*:*:*:*:*:*:* | 1.10.0 | Vulnerable | onosproject |
- cpe:2.3:a:onosproject:onos:1.8.0:*:*:*:*:*:*:* Versions 1.8.0 Vulnerable ·onosproject
- cpe:2.3:a:onosproject:onos:1.9.0:*:*:*:*:*:*:* Versions 1.9.0 Vulnerable ·onosproject
- cpe:2.3:a:onosproject:onos:1.10.0:*:*:*:*:*:*:* Versions 1.10.0 Vulnerable ·onosproject
Remediation
- Fix · GHSA-c6p7-vhw7-rc9w org.onosproject:onos-base (Maven) Fixed in 1.11.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2017-13763
- 2026-10-03 Alias added: GHSA-c6p7-vhw7-rc9w
References
Advisory 3
More onosproject Onos vulnerabilities
- TI-2023-14132 A cross-site scripting (XSS) vulnerability in Open Networking Foundation ONOS from… CVSS 3.1MEDIUM 6.1
- TI-2017-14418 Linux foundation ONOS 1.9.0 is vulnerable to unauthenticated upload of applications… CVSS 3.1CRITICAL 9.8
- TI-2019-10237 In ONOS 1.15.0, apps/yang/web/src/main/java/org/onosproject/yang/web/YangWebResource.java… CVSS 3.0CRITICAL 9.8
- TI-2018-15970 ONOS ONOS controller version 1.13.1 and earlier contains a XML External Entity (XXE)… CVSS 3.0CRITICAL 9.8
- TI-2018-15968 ONOS ONOS Controller version 1.13.1 and earlier contains a XML External Entity (XXE)… CVSS 3.0CRITICAL 9.8
- TI-2015-06254 ONOS before 1.5.0 when using the ifwd app allows remote attackers to cause a denial of… CVSS 3.0HIGH 7.5
Sources
- CVE-2017-13763 · CVE Program
- CVE-2017-13763 · NVD
- FIRST EPSS
- GHSA-c6p7-vhw7-rc9w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences