CVE-2026-76166
Modcluster-core: mod_cluster advertise listener: unauthenticated dos via crafted multicast datagram
A flaw was found in mod_cluster's AdvertiseListenerImpl (org.jboss.modcluster core module). A single crafted UDP multicast datagram with a valid HTTP status line and a "Server:" header but without the "Date:", "Digest:", and "Sequence:" headers triggers a NullPointerException in verifyDigest() that is not caught by the worker thread's exception handler. This causes the advertise listener thread to terminate permanently. The failure is silent (isListening() continues to return true) and persists until the node is restarted. The crash occurs before the AdvertiseSecurityKey comparison, so deployments with a configured security key are still affected.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Modcluster-core: mod_cluster advertise listener: unauthenticated dos via crafted multicast datagram
A flaw was found in mod_cluster's AdvertiseListenerImpl (org.jboss.modcluster core module). A single crafted UDP multicast datagram with a valid HTTP status line and a "Server:" header but without the "Date:", "Digest:", and "Sequence:" headers triggers a NullPointerException in verifyDigest() that is not caught by the worker thread's exception handler. This causes the advertise listener thread to terminate permanently. The failure is silent (isListening() continues to return true) and persists until the node is restarted. The crash occurs before the AdvertiseSecurityKey comparison, so deployments with a configured security key are still affected.
- Record
CVE-2026-76166- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-476
- Updated
- 2026-11-10
EUVDEUVD-2026-62367
A flaw was found in mod_cluster's AdvertiseListenerImpl (org.jboss.modcluster core module). A single crafted UDP multicast datagram with a valid HTTP status line and a "Server:" header but without the "Date:", "Digest:", and "Sequence:" headers triggers a NullPointerException in verifyDigest() that is not caught by the worker thread's exception handler. This causes the advertise listener thread to terminate permanently. The failure is silent (isListening() continues to return true) and persists until the node is restarted. The crash occurs before the AdvertiseSecurityKey comparison, so deployments with a configured security key are still affected.
- Record
EUVD-2026-62367- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-10
GitHub AdvisoriesGHSA-p4rg-ffff-6pmm
A flaw was found in mod_cluster's AdvertiseListenerImpl (org.jboss.modcluster core module). A...
A flaw was found in mod_cluster's AdvertiseListenerImpl (org.jboss.modcluster core module). A single crafted UDP multicast datagram with a valid HTTP status line and a "Server:" header but without the "Date:", "Digest:", and "Sequence:" headers triggers a NullPointerException in verifyDigest() that is not caught by the worker thread's exception handler. This causes the advertise listener thread to terminate permanently. The failure is silent (isListening() continues to return true) and persists until the node is restarted. The crash occurs before the AdvertiseSecurityKey comparison, so deployments with a configured security key are still affected.
- Record
GHSA-p4rg-ffff-6pmm- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-476
- Updated
- 2026-11-10
NVD
A flaw was found in mod_cluster's AdvertiseListenerImpl (org.jboss.modcluster core module). A single crafted UDP multicast datagram with a valid HTTP status line and a "Server:" header but without the "Date:", "Digest:", and "Sequence:" headers triggers a NullPointerException in verifyDigest() that is not caught by the worker thread's exception handler. This causes the advertise listener thread to terminate permanently. The failure is silent (isListening() continues to return true) and persists until the node is restarted. The crash occurs before the AdvertiseSecurityKey comparison, so deployments with a configured security key are still affected.
- Record
CVE-2026-76166- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-476
- Updated
- 2026-11-10
Affected products
- red hat jboss enterprise application platform 7
- red hat jboss enterprise application platform 8
- red hat jboss enterprise application platform expansion pack
- red hat jboss web server 5
- red hat jboss web server 6.2 on rhel 10
- red hat jboss web server 6.2 on rhel 8
- red hat jboss web server 6.2 on rhel 9
- red hat jboss web server 6.2.6
- red hat jboss web server 7.0 on rhel 10
- red hat jboss web server 7.0 on rhel 8
- red hat jboss web server 7.0 on rhel 9
- red hat jboss web server 7.0.3
Show 1 moreShow less
History
| Recorded | Changed | Sources |
|---|---|---|
| products, references | CVE List | |
| references | EUVD, NVD | |
| products, references | CVE List | |
| products, references | EUVD | |
| references | EUVD, GitHub Advisories, NVD | |
| products, references | CVE List | |
| facts, references | GitHub Advisories | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-76166 is a medium vulnerability (CVSS 4.3) in Red Hat Jboss Enterprise Application Platform 7, published August 19, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.40%, the 84th percentile. No source names a fixed version.
References
access.redhat.com/errata/RHSA-2026:93618
bugzilla.redhat.com/show_bug.cgi?id=2510883
nvd.nist.gov/vuln/detail/CVE-2026-76166
github.com/advisories/GHSA-p4rg-ffff-6pmm