CVE-2016-8612

Apache HTTP Server mod_cluster before version httpd 2.4.23 is vulnerable to an Improper Input...

4.3 MediumFix available

Apache HTTP Server mod_cluster before version httpd 2.4.23 is vulnerable to an Improper Input Validation in the protocol parsing logic in the load balancer resulting in a Segmentation Fault in the serving httpd process.

Attack profile

How easy it is to exploit

Attack vector: Adjacent network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: Low

Exploit likelihood

4.44%Up 2.7 points since Feb 4, 2022

What each source reports

NVD Score used 4.3

Record: CVE-2016-8612
CVSS 3.0: 4.3 MediumCVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 2.0: 3.3 LowAV:A/AC:L/Au:N/C:N/I:N/A:P
Weakness: CWE-20
Updated: 2026-11-02

CVE List No score

Record: CVE-2016-8612
Weakness: CWE-20
Updated: 2026-11-02

EUVDEUVD-2016-9458 No score

Record: EUVD-2016-9458
Updated: 2026-11-03

GitHub AdvisoriesGHSA-pw68-p55m-86x8 4.3

Apache HTTP Server mod_cluster before version httpd 2.4.23 is vulnerable to an Improper Input...

Record: GHSA-pw68-p55m-86x8
CVSS 3.0: 4.3 MediumCVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness: CWE-20
Updated: 2026-11-02

OSV 4.3

Record: CVE-2016-8612
CVSS 3.0: 4.3 MediumCVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSVRHSA-2017:0193 8.1

Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Release on RHEL 6

Record: RHSA-2017:0193
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2017:0194 8.1

Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Release on RHEL 7

Record: RHSA-2017:0194
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`jbcs-httpd24-httpd` Red Hat:jboss_core_services:1::el6	before 0:2.4.23-102.jbcs.el6	0:2.4.23-102.jbcs.el6
`jbcs-httpd24-httpd-debuginfo` Red Hat:jboss_core_services:1::el6	before 0:2.4.23-102.jbcs.el6	0:2.4.23-102.jbcs.el6
`jbcs-httpd24-httpd-devel` Red Hat:jboss_core_services:1::el6	before 0:2.4.23-102.jbcs.el6	0:2.4.23-102.jbcs.el6
`jbcs-httpd24-httpd-manual` Red Hat:jboss_core_services:1::el6	before 0:2.4.23-102.jbcs.el6	0:2.4.23-102.jbcs.el6
`jbcs-httpd24-httpd-selinux` Red Hat:jboss_core_services:1::el6	before 0:2.4.23-102.jbcs.el6	0:2.4.23-102.jbcs.el6
`jbcs-httpd24-httpd-src-zip` Red Hat:jboss_core_services:1::el6	before 0:2.4.23-102.jbcs.el6	0:2.4.23-102.jbcs.el6
`jbcs-httpd24-httpd-tools` Red Hat:jboss_core_services:1::el6	before 0:2.4.23-102.jbcs.el6	0:2.4.23-102.jbcs.el6
`jbcs-httpd24-httpd-zip` Red Hat:jboss_core_services:1::el6	before 0:2.4.23-102.jbcs.el6	0:2.4.23-102.jbcs.el6
`jbcs-httpd24-mod_auth_kerb` Red Hat:jboss_core_services:1::el6	before 0:5.4-35.jbcs.el6	0:5.4-35.jbcs.el6
`jbcs-httpd24-mod_auth_kerb-debuginfo` Red Hat:jboss_core_services:1::el6	before 0:5.4-35.jbcs.el6	0:5.4-35.jbcs.el6

Show 66 moreShow less

Affected packages
Package	Affected	Fixed
`jbcs-httpd24-mod_bmx` Red Hat:jboss_core_services:1::el6	before 0:0.9.6-14.GA.jbcs.el6	0:0.9.6-14.GA.jbcs.el6
`jbcs-httpd24-mod_bmx-debuginfo` Red Hat:jboss_core_services:1::el6	before 0:0.9.6-14.GA.jbcs.el6	0:0.9.6-14.GA.jbcs.el6
`jbcs-httpd24-mod_bmx-src-zip` Red Hat:jboss_core_services:1::el6	before 0:0.9.6-14.GA.jbcs.el6	0:0.9.6-14.GA.jbcs.el6
`jbcs-httpd24-mod_cluster-native` Red Hat:jboss_core_services:1::el6	before 0:1.3.5-13.Final_redhat_1.jbcs.el6	0:1.3.5-13.Final_redhat_1.jbcs.el6
`jbcs-httpd24-mod_cluster-native-debuginfo` Red Hat:jboss_core_services:1::el6	before 0:1.3.5-13.Final_redhat_1.jbcs.el6	0:1.3.5-13.Final_redhat_1.jbcs.el6
`jbcs-httpd24-mod_cluster-native-src-zip` Red Hat:jboss_core_services:1::el6	before 0:1.3.5-13.Final_redhat_1.jbcs.el6	0:1.3.5-13.Final_redhat_1.jbcs.el6
`jbcs-httpd24-mod_jk` Red Hat:jboss_core_services:1::el6	before 0:1.2.41-14.redhat_1.jbcs.el6	0:1.2.41-14.redhat_1.jbcs.el6
`jbcs-httpd24-mod_jk-ap24` Red Hat:jboss_core_services:1::el6	before 0:1.2.41-14.redhat_1.jbcs.el6	0:1.2.41-14.redhat_1.jbcs.el6
`jbcs-httpd24-mod_jk-debuginfo` Red Hat:jboss_core_services:1::el6	before 0:1.2.41-14.redhat_1.jbcs.el6	0:1.2.41-14.redhat_1.jbcs.el6
`jbcs-httpd24-mod_jk-manual` Red Hat:jboss_core_services:1::el6	before 0:1.2.41-14.redhat_1.jbcs.el6	0:1.2.41-14.redhat_1.jbcs.el6
`jbcs-httpd24-mod_jk-src-zip` Red Hat:jboss_core_services:1::el6	before 0:1.2.41-14.redhat_1.jbcs.el6	0:1.2.41-14.redhat_1.jbcs.el6
`jbcs-httpd24-mod_ldap` Red Hat:jboss_core_services:1::el6	before 0:2.4.23-102.jbcs.el6	0:2.4.23-102.jbcs.el6
`jbcs-httpd24-mod_proxy_html` Red Hat:jboss_core_services:1::el6	before 1:2.4.23-102.jbcs.el6	1:2.4.23-102.jbcs.el6
`jbcs-httpd24-mod_rt` Red Hat:jboss_core_services:1::el6	before 0:2.4.1-16.GA.jbcs.el6	0:2.4.1-16.GA.jbcs.el6
`jbcs-httpd24-mod_rt-debuginfo` Red Hat:jboss_core_services:1::el6	before 0:2.4.1-16.GA.jbcs.el6	0:2.4.1-16.GA.jbcs.el6
`jbcs-httpd24-mod_rt-src-zip` Red Hat:jboss_core_services:1::el6	before 0:2.4.1-16.GA.jbcs.el6	0:2.4.1-16.GA.jbcs.el6
`jbcs-httpd24-mod_security` Red Hat:jboss_core_services:1::el6	before 0:2.9.1-18.GA.jbcs.el6	0:2.9.1-18.GA.jbcs.el6
`jbcs-httpd24-mod_security-debuginfo` Red Hat:jboss_core_services:1::el6	before 0:2.9.1-18.GA.jbcs.el6	0:2.9.1-18.GA.jbcs.el6
`jbcs-httpd24-mod_security-src-zip` Red Hat:jboss_core_services:1::el6	before 0:2.9.1-18.GA.jbcs.el6	0:2.9.1-18.GA.jbcs.el6
`jbcs-httpd24-mod_session` Red Hat:jboss_core_services:1::el6	before 0:2.4.23-102.jbcs.el6	0:2.4.23-102.jbcs.el6
`jbcs-httpd24-mod_ssl` Red Hat:jboss_core_services:1::el6	before 1:2.4.23-102.jbcs.el6	1:2.4.23-102.jbcs.el6
`jbcs-httpd24-nghttp2` Red Hat:jboss_core_services:1::el6	before 0:1.12.0-9.jbcs.el6	0:1.12.0-9.jbcs.el6
`jbcs-httpd24-nghttp2-debuginfo` Red Hat:jboss_core_services:1::el6	before 0:1.12.0-9.jbcs.el6	0:1.12.0-9.jbcs.el6
`jbcs-httpd24-openssl` Red Hat:jboss_core_services:1::el6	before 1:1.0.2h-12.jbcs.el6	1:1.0.2h-12.jbcs.el6
`jbcs-httpd24-openssl-debuginfo` Red Hat:jboss_core_services:1::el6	before 1:1.0.2h-12.jbcs.el6	1:1.0.2h-12.jbcs.el6
`jbcs-httpd24-openssl-devel` Red Hat:jboss_core_services:1::el6	before 1:1.0.2h-12.jbcs.el6	1:1.0.2h-12.jbcs.el6
`jbcs-httpd24-openssl-libs` Red Hat:jboss_core_services:1::el6	before 1:1.0.2h-12.jbcs.el6	1:1.0.2h-12.jbcs.el6
`jbcs-httpd24-openssl-perl` Red Hat:jboss_core_services:1::el6	before 1:1.0.2h-12.jbcs.el6	1:1.0.2h-12.jbcs.el6
`jbcs-httpd24-openssl-static` Red Hat:jboss_core_services:1::el6	before 1:1.0.2h-12.jbcs.el6	1:1.0.2h-12.jbcs.el6
`jbcs-httpd24-httpd` Red Hat:jboss_core_services:1::el7	before 0:2.4.23-102.jbcs.el7	0:2.4.23-102.jbcs.el7
`jbcs-httpd24-httpd-debuginfo` Red Hat:jboss_core_services:1::el7	before 0:2.4.23-102.jbcs.el7	0:2.4.23-102.jbcs.el7
`jbcs-httpd24-httpd-devel` Red Hat:jboss_core_services:1::el7	before 0:2.4.23-102.jbcs.el7	0:2.4.23-102.jbcs.el7
`jbcs-httpd24-httpd-manual` Red Hat:jboss_core_services:1::el7	before 0:2.4.23-102.jbcs.el7	0:2.4.23-102.jbcs.el7
`jbcs-httpd24-httpd-selinux` Red Hat:jboss_core_services:1::el7	before 0:2.4.23-102.jbcs.el7	0:2.4.23-102.jbcs.el7
`jbcs-httpd24-httpd-src-zip` Red Hat:jboss_core_services:1::el7	before 0:2.4.23-102.jbcs.el7	0:2.4.23-102.jbcs.el7
`jbcs-httpd24-httpd-tools` Red Hat:jboss_core_services:1::el7	before 0:2.4.23-102.jbcs.el7	0:2.4.23-102.jbcs.el7
`jbcs-httpd24-httpd-zip` Red Hat:jboss_core_services:1::el7	before 0:2.4.23-102.jbcs.el7	0:2.4.23-102.jbcs.el7
`jbcs-httpd24-mod_auth_kerb` Red Hat:jboss_core_services:1::el7	before 0:5.4-35.jbcs.el7	0:5.4-35.jbcs.el7
`jbcs-httpd24-mod_auth_kerb-debuginfo` Red Hat:jboss_core_services:1::el7	before 0:5.4-35.jbcs.el7	0:5.4-35.jbcs.el7
`jbcs-httpd24-mod_bmx` Red Hat:jboss_core_services:1::el7	before 0:0.9.6-14.GA.jbcs.el7	0:0.9.6-14.GA.jbcs.el7
`jbcs-httpd24-mod_bmx-debuginfo` Red Hat:jboss_core_services:1::el7	before 0:0.9.6-14.GA.jbcs.el7	0:0.9.6-14.GA.jbcs.el7
`jbcs-httpd24-mod_bmx-src-zip` Red Hat:jboss_core_services:1::el7	before 0:0.9.6-14.GA.jbcs.el7	0:0.9.6-14.GA.jbcs.el7
`jbcs-httpd24-mod_cluster-native` Red Hat:jboss_core_services:1::el7	before 0:1.3.5-13.Final_redhat_1.jbcs.el7	0:1.3.5-13.Final_redhat_1.jbcs.el7
`jbcs-httpd24-mod_cluster-native-debuginfo` Red Hat:jboss_core_services:1::el7	before 0:1.3.5-13.Final_redhat_1.jbcs.el7	0:1.3.5-13.Final_redhat_1.jbcs.el7
`jbcs-httpd24-mod_jk` Red Hat:jboss_core_services:1::el7	before 0:1.2.41-14.redhat_1.jbcs.el7	0:1.2.41-14.redhat_1.jbcs.el7
`jbcs-httpd24-mod_jk-ap24` Red Hat:jboss_core_services:1::el7	before 0:1.2.41-14.redhat_1.jbcs.el7	0:1.2.41-14.redhat_1.jbcs.el7
`jbcs-httpd24-mod_jk-debuginfo` Red Hat:jboss_core_services:1::el7	before 0:1.2.41-14.redhat_1.jbcs.el7	0:1.2.41-14.redhat_1.jbcs.el7
`jbcs-httpd24-mod_jk-manual` Red Hat:jboss_core_services:1::el7	before 0:1.2.41-14.redhat_1.jbcs.el7	0:1.2.41-14.redhat_1.jbcs.el7
`jbcs-httpd24-mod_ldap` Red Hat:jboss_core_services:1::el7	before 0:2.4.23-102.jbcs.el7	0:2.4.23-102.jbcs.el7
`jbcs-httpd24-mod_proxy_html` Red Hat:jboss_core_services:1::el7	before 1:2.4.23-102.jbcs.el7	1:2.4.23-102.jbcs.el7
`jbcs-httpd24-mod_rt` Red Hat:jboss_core_services:1::el7	before 0:2.4.1-16.GA.jbcs.el7	0:2.4.1-16.GA.jbcs.el7
`jbcs-httpd24-mod_rt-debuginfo` Red Hat:jboss_core_services:1::el7	before 0:2.4.1-16.GA.jbcs.el7	0:2.4.1-16.GA.jbcs.el7
`jbcs-httpd24-mod_rt-src-zip` Red Hat:jboss_core_services:1::el7	before 0:2.4.1-16.GA.jbcs.el7	0:2.4.1-16.GA.jbcs.el7
`jbcs-httpd24-mod_security` Red Hat:jboss_core_services:1::el7	before 0:2.9.1-18.GA.jbcs.el7	0:2.9.1-18.GA.jbcs.el7
`jbcs-httpd24-mod_security-debuginfo` Red Hat:jboss_core_services:1::el7	before 0:2.9.1-18.GA.jbcs.el7	0:2.9.1-18.GA.jbcs.el7
`jbcs-httpd24-mod_security-src-zip` Red Hat:jboss_core_services:1::el7	before 0:2.9.1-18.GA.jbcs.el7	0:2.9.1-18.GA.jbcs.el7
`jbcs-httpd24-mod_session` Red Hat:jboss_core_services:1::el7	before 0:2.4.23-102.jbcs.el7	0:2.4.23-102.jbcs.el7
`jbcs-httpd24-mod_ssl` Red Hat:jboss_core_services:1::el7	before 1:2.4.23-102.jbcs.el7	1:2.4.23-102.jbcs.el7
`jbcs-httpd24-nghttp2` Red Hat:jboss_core_services:1::el7	before 0:1.12.0-9.jbcs.el7	0:1.12.0-9.jbcs.el7
`jbcs-httpd24-nghttp2-debuginfo` Red Hat:jboss_core_services:1::el7	before 0:1.12.0-9.jbcs.el7	0:1.12.0-9.jbcs.el7
`jbcs-httpd24-openssl` Red Hat:jboss_core_services:1::el7	before 1:1.0.2h-12.jbcs.el7	1:1.0.2h-12.jbcs.el7
`jbcs-httpd24-openssl-debuginfo` Red Hat:jboss_core_services:1::el7	before 1:1.0.2h-12.jbcs.el7	1:1.0.2h-12.jbcs.el7
`jbcs-httpd24-openssl-devel` Red Hat:jboss_core_services:1::el7	before 1:1.0.2h-12.jbcs.el7	1:1.0.2h-12.jbcs.el7
`jbcs-httpd24-openssl-libs` Red Hat:jboss_core_services:1::el7	before 1:1.0.2h-12.jbcs.el7	1:1.0.2h-12.jbcs.el7
`jbcs-httpd24-openssl-perl` Red Hat:jboss_core_services:1::el7	before 1:1.0.2h-12.jbcs.el7	1:1.0.2h-12.jbcs.el7
`jbcs-httpd24-openssl-static` Red Hat:jboss_core_services:1::el7	before 1:1.0.2h-12.jbcs.el7	1:1.0.2h-12.jbcs.el7

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-8612 is a medium vulnerability (CVSS 4.3) in Apache Http Server, published March 9, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.44%, the 91st percentile. Fixed in jbcs-httpd24-httpd 0:2.4.23-102.jbcs.el6.

References

Show 32 moreShow less