CVE-2016-8612
Apache HTTP Server mod_cluster before version httpd 2.4.23 is vulnerable to an Improper Input...
4.3 Medium
CVE-2016-8612 is a medium vulnerability (CVSS 4.3) in Apache Http Server, published March 9, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.44%, the 91st percentile. No source names a fixed version.
- Severity
- 4.3 MediumCVSS 3.0, NVD
- Exploit chance
- 4.44%EPSS, 91st percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
Apache HTTP Server mod_cluster before version httpd 2.4.23 is vulnerable to an Improper Input Validation in the protocol parsing logic in the load balancer resulting in a Segmentation Fault in the serving httpd process.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
4.44%Up 2.7 points since Feb 4, 2022
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
jbcs-httpd24-httpdRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs | before 0:2.4.23-102.jbcs.el6 | 0:2.4.23-102.jbcs.el6 |
jbcs-httpd24-httpd-debuginfoRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs | before 0:2.4.23-102.jbcs.el6 | 0:2.4.23-102.jbcs.el6 |
jbcs-httpd24-httpd-develRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs | before 0:2.4.23-102.jbcs.el6 | 0:2.4.23-102.jbcs.el6 |
jbcs-httpd24-httpd-manualRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs | before 0:2.4.23-102.jbcs.el6 | 0:2.4.23-102.jbcs.el6 |
jbcs-httpd24-httpd-selinuxRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs | before 0:2.4.23-102.jbcs.el6 | 0:2.4.23-102.jbcs.el6 |
jbcs-httpd24-httpd-src-zipRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs | before 0:2.4.23-102.jbcs.el6 | 0:2.4.23-102.jbcs.el6 |
jbcs-httpd24-httpd-toolsRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs | before 0:2.4.23-102.jbcs.el6 | 0:2.4.23-102.jbcs.el6 |
jbcs-httpd24-httpd-zipRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs | before 0:2.4.23-102.jbcs.el6 | 0:2.4.23-102.jbcs.el6 |
jbcs-httpd24-mod_auth_kerbRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs | before 0:5.4-35.jbcs.el6 | 0:5.4-35.jbcs.el6 |
jbcs-httpd24-mod_auth_kerb-debuginfoRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs | before 0:5.4-35.jbcs.el6 | 0:5.4-35.jbcs.el6 |
Show 66 moreShow less
| Package | Affected | Fixed |
|---|---|---|
jbcs-httpd24-mod_bmxRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs | before 0:0.9.6-14.GA.jbcs.el6 | 0:0.9.6-14.GA.jbcs.el6 |
jbcs-httpd24-mod_bmx-debuginfoRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs | before 0:0.9.6-14.GA.jbcs.el6 | 0:0.9.6-14.GA.jbcs.el6 |
jbcs-httpd24-mod_bmx-src-zipRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs | before 0:0.9.6-14.GA.jbcs.el6 | 0:0.9.6-14.GA.jbcs.el6 |
jbcs-httpd24-mod_cluster-nativeRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs | before 0:1.3.5-13.Final_redhat_1.jbcs.el6 | 0:1.3.5-13.Final_redhat_1.jbcs.el6 |
jbcs-httpd24-mod_cluster-native-debuginfoRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs | before 0:1.3.5-13.Final_redhat_1.jbcs.el6 | 0:1.3.5-13.Final_redhat_1.jbcs.el6 |
jbcs-httpd24-mod_cluster-native-src-zipRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs | before 0:1.3.5-13.Final_redhat_1.jbcs.el6 | 0:1.3.5-13.Final_redhat_1.jbcs.el6 |
jbcs-httpd24-mod_jkRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs | before 0:1.2.41-14.redhat_1.jbcs.el6 | 0:1.2.41-14.redhat_1.jbcs.el6 |
jbcs-httpd24-mod_jk-ap24Red Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs | before 0:1.2.41-14.redhat_1.jbcs.el6 | 0:1.2.41-14.redhat_1.jbcs.el6 |
jbcs-httpd24-mod_jk-debuginfoRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs | before 0:1.2.41-14.redhat_1.jbcs.el6 | 0:1.2.41-14.redhat_1.jbcs.el6 |
jbcs-httpd24-mod_jk-manualRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs | before 0:1.2.41-14.redhat_1.jbcs.el6 | 0:1.2.41-14.redhat_1.jbcs.el6 |
jbcs-httpd24-mod_jk-src-zipRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs | before 0:1.2.41-14.redhat_1.jbcs.el6 | 0:1.2.41-14.redhat_1.jbcs.el6 |
jbcs-httpd24-mod_ldapRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs | before 0:2.4.23-102.jbcs.el6 | 0:2.4.23-102.jbcs.el6 |
jbcs-httpd24-mod_proxy_htmlRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs | before 1:2.4.23-102.jbcs.el6 | 1:2.4.23-102.jbcs.el6 |
jbcs-httpd24-mod_rtRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs | before 0:2.4.1-16.GA.jbcs.el6 | 0:2.4.1-16.GA.jbcs.el6 |
jbcs-httpd24-mod_rt-debuginfoRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs | before 0:2.4.1-16.GA.jbcs.el6 | 0:2.4.1-16.GA.jbcs.el6 |
jbcs-httpd24-mod_rt-src-zipRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs | before 0:2.4.1-16.GA.jbcs.el6 | 0:2.4.1-16.GA.jbcs.el6 |
jbcs-httpd24-mod_securityRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs | before 0:2.9.1-18.GA.jbcs.el6 | 0:2.9.1-18.GA.jbcs.el6 |
jbcs-httpd24-mod_security-debuginfoRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs | before 0:2.9.1-18.GA.jbcs.el6 | 0:2.9.1-18.GA.jbcs.el6 |
jbcs-httpd24-mod_security-src-zipRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs | before 0:2.9.1-18.GA.jbcs.el6 | 0:2.9.1-18.GA.jbcs.el6 |
jbcs-httpd24-mod_sessionRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs | before 0:2.4.23-102.jbcs.el6 | 0:2.4.23-102.jbcs.el6 |
jbcs-httpd24-mod_sslRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs | before 1:2.4.23-102.jbcs.el6 | 1:2.4.23-102.jbcs.el6 |
jbcs-httpd24-nghttp2Red Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs | before 0:1.12.0-9.jbcs.el6 | 0:1.12.0-9.jbcs.el6 |
jbcs-httpd24-nghttp2-debuginfoRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs | before 0:1.12.0-9.jbcs.el6 | 0:1.12.0-9.jbcs.el6 |
jbcs-httpd24-opensslRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs | before 1:1.0.2h-12.jbcs.el6 | 1:1.0.2h-12.jbcs.el6 |
jbcs-httpd24-openssl-debuginfoRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs | before 1:1.0.2h-12.jbcs.el6 | 1:1.0.2h-12.jbcs.el6 |
jbcs-httpd24-openssl-develRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs | before 1:1.0.2h-12.jbcs.el6 | 1:1.0.2h-12.jbcs.el6 |
jbcs-httpd24-openssl-libsRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs | before 1:1.0.2h-12.jbcs.el6 | 1:1.0.2h-12.jbcs.el6 |
jbcs-httpd24-openssl-perlRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs | before 1:1.0.2h-12.jbcs.el6 | 1:1.0.2h-12.jbcs.el6 |
jbcs-httpd24-openssl-staticRed Hat:jboss_core_services:1::el6 From an advisory covering 6 CVEs | before 1:1.0.2h-12.jbcs.el6 | 1:1.0.2h-12.jbcs.el6 |
jbcs-httpd24-httpdRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs | before 0:2.4.23-102.jbcs.el7 | 0:2.4.23-102.jbcs.el7 |
jbcs-httpd24-httpd-debuginfoRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs | before 0:2.4.23-102.jbcs.el7 | 0:2.4.23-102.jbcs.el7 |
jbcs-httpd24-httpd-develRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs | before 0:2.4.23-102.jbcs.el7 | 0:2.4.23-102.jbcs.el7 |
jbcs-httpd24-httpd-manualRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs | before 0:2.4.23-102.jbcs.el7 | 0:2.4.23-102.jbcs.el7 |
jbcs-httpd24-httpd-selinuxRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs | before 0:2.4.23-102.jbcs.el7 | 0:2.4.23-102.jbcs.el7 |
jbcs-httpd24-httpd-src-zipRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs | before 0:2.4.23-102.jbcs.el7 | 0:2.4.23-102.jbcs.el7 |
jbcs-httpd24-httpd-toolsRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs | before 0:2.4.23-102.jbcs.el7 | 0:2.4.23-102.jbcs.el7 |
jbcs-httpd24-httpd-zipRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs | before 0:2.4.23-102.jbcs.el7 | 0:2.4.23-102.jbcs.el7 |
jbcs-httpd24-mod_auth_kerbRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs | before 0:5.4-35.jbcs.el7 | 0:5.4-35.jbcs.el7 |
jbcs-httpd24-mod_auth_kerb-debuginfoRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs | before 0:5.4-35.jbcs.el7 | 0:5.4-35.jbcs.el7 |
jbcs-httpd24-mod_bmxRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs | before 0:0.9.6-14.GA.jbcs.el7 | 0:0.9.6-14.GA.jbcs.el7 |
jbcs-httpd24-mod_bmx-debuginfoRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs | before 0:0.9.6-14.GA.jbcs.el7 | 0:0.9.6-14.GA.jbcs.el7 |
jbcs-httpd24-mod_bmx-src-zipRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs | before 0:0.9.6-14.GA.jbcs.el7 | 0:0.9.6-14.GA.jbcs.el7 |
jbcs-httpd24-mod_cluster-nativeRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs | before 0:1.3.5-13.Final_redhat_1.jbcs.el7 | 0:1.3.5-13.Final_redhat_1.jbcs.el7 |
jbcs-httpd24-mod_cluster-native-debuginfoRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs | before 0:1.3.5-13.Final_redhat_1.jbcs.el7 | 0:1.3.5-13.Final_redhat_1.jbcs.el7 |
jbcs-httpd24-mod_jkRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs | before 0:1.2.41-14.redhat_1.jbcs.el7 | 0:1.2.41-14.redhat_1.jbcs.el7 |
jbcs-httpd24-mod_jk-ap24Red Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs | before 0:1.2.41-14.redhat_1.jbcs.el7 | 0:1.2.41-14.redhat_1.jbcs.el7 |
jbcs-httpd24-mod_jk-debuginfoRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs | before 0:1.2.41-14.redhat_1.jbcs.el7 | 0:1.2.41-14.redhat_1.jbcs.el7 |
jbcs-httpd24-mod_jk-manualRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs | before 0:1.2.41-14.redhat_1.jbcs.el7 | 0:1.2.41-14.redhat_1.jbcs.el7 |
jbcs-httpd24-mod_ldapRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs | before 0:2.4.23-102.jbcs.el7 | 0:2.4.23-102.jbcs.el7 |
jbcs-httpd24-mod_proxy_htmlRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs | before 1:2.4.23-102.jbcs.el7 | 1:2.4.23-102.jbcs.el7 |
jbcs-httpd24-mod_rtRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs | before 0:2.4.1-16.GA.jbcs.el7 | 0:2.4.1-16.GA.jbcs.el7 |
jbcs-httpd24-mod_rt-debuginfoRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs | before 0:2.4.1-16.GA.jbcs.el7 | 0:2.4.1-16.GA.jbcs.el7 |
jbcs-httpd24-mod_rt-src-zipRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs | before 0:2.4.1-16.GA.jbcs.el7 | 0:2.4.1-16.GA.jbcs.el7 |
jbcs-httpd24-mod_securityRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs | before 0:2.9.1-18.GA.jbcs.el7 | 0:2.9.1-18.GA.jbcs.el7 |
jbcs-httpd24-mod_security-debuginfoRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs | before 0:2.9.1-18.GA.jbcs.el7 | 0:2.9.1-18.GA.jbcs.el7 |
jbcs-httpd24-mod_security-src-zipRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs | before 0:2.9.1-18.GA.jbcs.el7 | 0:2.9.1-18.GA.jbcs.el7 |
jbcs-httpd24-mod_sessionRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs | before 0:2.4.23-102.jbcs.el7 | 0:2.4.23-102.jbcs.el7 |
jbcs-httpd24-mod_sslRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs | before 1:2.4.23-102.jbcs.el7 | 1:2.4.23-102.jbcs.el7 |
jbcs-httpd24-nghttp2Red Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs | before 0:1.12.0-9.jbcs.el7 | 0:1.12.0-9.jbcs.el7 |
jbcs-httpd24-nghttp2-debuginfoRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs | before 0:1.12.0-9.jbcs.el7 | 0:1.12.0-9.jbcs.el7 |
jbcs-httpd24-opensslRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs | before 1:1.0.2h-12.jbcs.el7 | 1:1.0.2h-12.jbcs.el7 |
jbcs-httpd24-openssl-debuginfoRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs | before 1:1.0.2h-12.jbcs.el7 | 1:1.0.2h-12.jbcs.el7 |
jbcs-httpd24-openssl-develRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs | before 1:1.0.2h-12.jbcs.el7 | 1:1.0.2h-12.jbcs.el7 |
jbcs-httpd24-openssl-libsRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs | before 1:1.0.2h-12.jbcs.el7 | 1:1.0.2h-12.jbcs.el7 |
jbcs-httpd24-openssl-perlRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs | before 1:1.0.2h-12.jbcs.el7 | 1:1.0.2h-12.jbcs.el7 |
jbcs-httpd24-openssl-staticRed Hat:jboss_core_services:1::el7 From an advisory covering 6 CVEs | before 1:1.0.2h-12.jbcs.el7 | 1:1.0.2h-12.jbcs.el7 |
What each source reports
NVD Score used
Apache HTTP Server mod_cluster before version httpd 2.4.23 is vulnerable to an Improper Input Validation in the protocol parsing logic in the load balancer resulting in a Segmentation Fault in the serving httpd process.
- Record
CVE-2016-8612- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - CVSS 2.0
- 3.3 Low
AV:A/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE ListNo score
Apache HTTP Server mod_cluster before version httpd 2.4.23 is vulnerable to an Improper Input Validation in the protocol parsing logic in the load balancer resulting in a Segmentation Fault in the serving httpd process.
- Record
CVE-2016-8612- Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2016-9458No score
Apache HTTP Server mod_cluster before version httpd 2.4.23 is vulnerable to an Improper Input Validation in the protocol parsing logic in the load balancer resulting in a Segmentation Fault in the serving httpd process.
- Record
EUVD-2016-9458- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pw68-p55m-86x8
Apache HTTP Server mod_cluster before version httpd 2.4.23 is vulnerable to an Improper Input...
Apache HTTP Server mod_cluster before version httpd 2.4.23 is vulnerable to an Improper Input Validation in the protocol parsing logic in the load balancer resulting in a Segmentation Fault in the serving httpd process.
- Record
GHSA-pw68-p55m-86x8- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
Apache HTTP Server mod_cluster before version httpd 2.4.23 is vulnerable to an Improper Input Validation in the protocol parsing logic in the load balancer resulting in a Segmentation Fault in the serving httpd process.
- Record
CVE-2016-8612- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVRHSA-2017:0193
Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Release on RHEL 6
- Record
RHSA-2017:0193- CVSS 3.0
- 8.1 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2017:0194
Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Release on RHEL 7
- Record
RHSA-2017:0194- CVSS 3.0
- 8.1 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
securityfocus.com/bid/94939
security.netapp.com/advisory/ntap-20180601-0005
access.redhat.com/errata/RHSA-2017:0194
rhn.redhat.com/errata/RHSA-2016-2957.html
bugzilla.redhat.com/show_bug.cgi?id=1387605
Show 32 moreShow less
nvd.nist.gov/vuln/detail/CVE-2016-8612
github.com/advisories/GHSA-pw68-p55m-86x8
security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0193.json
cve.org/CVERecord?id=CVE-2016-2108
openssl.org/news/secadv/20160503.txt
openssl.org/news/secadv/20160922.txt
eprint.iacr.org/2016/594
tomcat.apache.org/security-jk.html