{"id":"CVE-2016-3110","aliases":["EUVD-2016-4163","GHSA-68qq-3phh-53j7","RHSA-2016:1648","RHSA-2016:1649","RHSA-2016:2054","RHSA-2016:2055"],"status":"published","title":"mod_cluster Denial of Service vulnerability","description":"mod_cluster, as used in Red Hat JBoss Web Server 2.1, allows remote attackers to cause a denial of service (Apache http server crash) via an MCMP message containing a series of = (equals) characters after a legitimate element.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.0364,"percentile":0.89645,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2016-09-26T14:00:00Z","modified":"2026-09-21T10:01:30Z","fixes":[{"ecosystem":"Maven","package":"org.jboss.mod_cluster:mod_cluster-parent","fixed_in":["1.3.3.Final"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.jboss.mod_cluster:mod_cluster-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3.Final"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.jboss.mod_cluster:mod_cluster-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3.Final"}]}],"versions":["1.2.0.Beta1","1.2.0.Beta2","1.2.0.Beta4","1.2.0.Final","1.2.1.Beta1","1.2.1.Beta2","1.2.1.Final","1.2.10.Final","1.2.11.Final","1.2.12.Final","1.2.13.Final","1.2.14.Final","1.2.2.Final","1.2.3.Final","1.2.4.Final","1.2.5.Final","1.2.6.Final","1.2.7.Final","1.2.8.Final","1.2.9.Final","1.3.0.Alpha1","1.3.0.Final","1.3.1.Alpha1","1.3.1.Alpha2","1.3.1.Beta1","1.3.1.Beta2","1.3.1.Final","1.3.2.Final"]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"httpd22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.26-56.ep6.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"httpd22-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.26-56.ep6.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"httpd22-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.26-56.ep6.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"httpd22-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.26-56.ep6.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"httpd22-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.26-56.ep6.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"jbcs-httpd24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1-3.jbcs.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"jbcs-httpd24-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2h-4.jbcs.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"jbcs-httpd24-openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2h-4.jbcs.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"jbcs-httpd24-openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2h-4.jbcs.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"jbcs-httpd24-openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2h-4.jbcs.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"jbcs-httpd24-openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2h-4.jbcs.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"jbcs-httpd24-openssl-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2h-4.jbcs.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"jbcs-httpd24-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1-3.jbcs.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"mod_cluster","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.13-1.Final_redhat_1.1.ep6.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"mod_cluster-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.13-3.Final_redhat_2.ep6.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"mod_cluster-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.13-3.Final_redhat_2.ep6.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"mod_cluster-tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.13-1.Final_redhat_1.1.ep6.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"mod_cluster-tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.13-1.Final_redhat_1.1.ep6.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"mod_jk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.41-2.redhat_3.ep6.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"mod_jk-ap22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.41-2.redhat_3.ep6.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"mod_jk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.41-2.redhat_3.ep6.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"mod_jk-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.41-2.redhat_3.ep6.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"mod_ssl22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.26-56.ep6.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.34-5.redhat_1.ep6.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.34-5.redhat_1.ep6.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.26-54.ep6.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.26-54.ep6.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.26-54.ep6.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.26-54.ep6.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.26-54.ep6.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"jbcs-httpd24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1-3.jbcs.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"jbcs-httpd24-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2h-4.jbcs.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"jbcs-httpd24-openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2h-4.jbcs.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"jbcs-httpd24-openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2h-4.jbcs.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"jbcs-httpd24-openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2h-4.jbcs.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"jbcs-httpd24-openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2h-4.jbcs.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"jbcs-httpd24-openssl-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2h-4.jbcs.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"jbcs-httpd24-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1-3.jbcs.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"mod_cluster","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.13-1.Final_redhat_1.1.ep6.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"mod_cluster-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.13-3.Final_redhat_2.ep6.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"mod_cluster-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.13-3.Final_redhat_2.ep6.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"mod_cluster-tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.13-1.Final_redhat_1.1.ep6.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"mod_cluster-tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.13-1.Final_redhat_1.1.ep6.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"mod_jk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.41-2.redhat_3.ep6.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"mod_jk-ap22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.41-2.redhat_3.ep6.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"mod_jk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.41-2.redhat_3.ep6.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"mod_jk-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.41-2.redhat_3.ep6.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.26-54.ep6.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.34-5.redhat_1.ep6.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.34-5.redhat_1.ep6.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el7","package":"hornetq-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.25-4.SP11_redhat_1.ep6.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el7","package":"hornetq-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.25-4.SP11_redhat_1.ep6.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el7","package":"httpd22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.26-56.ep6.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el7","package":"httpd22-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.26-56.ep6.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el7","package":"httpd22-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.26-56.ep6.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el7","package":"httpd22-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.26-56.ep6.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el7","package":"httpd22-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.26-56.ep6.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el7","package":"jbcs-httpd24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1-3.jbcs.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el7","package":"jbcs-httpd24-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2h-4.jbcs.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el7","package":"jbcs-httpd24-openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2h-4.jbcs.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el7","package":"jbcs-httpd24-openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2h-4.jbcs.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el7","package":"jbcs-httpd24-openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2h-4.jbcs.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el7","package":"jbcs-httpd24-openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2h-4.jbcs.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el7","package":"jbcs-httpd24-openssl-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2h-4.jbcs.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el7","package":"jbcs-httpd24-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1-3.jbcs.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el7","package":"jbossas-hornetq-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.25-4.SP11_redhat_1.ep6.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el7","package":"jbossas-jbossweb-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.34-5.redhat_1.ep6.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el7","package":"mod_cluster-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.13-3.Final_redhat_2.ep6.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el7","package":"mod_cluster-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.13-3.Final_redhat_2.ep6.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el7","package":"mod_jk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.41-2.redhat_4.ep6.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el7","package":"mod_jk-ap22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.41-2.redhat_4.ep6.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el7","package":"mod_jk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.41-2.redhat_4.ep6.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el7","package":"mod_ldap22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.26-56.ep6.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el7","package":"mod_ssl22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.26-56.ep6.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el7","package":"tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.34-5.redhat_1.ep6.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el7","package":"tomcat-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.34-5.redhat_1.ep6.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"hornetq-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.25-4.SP11_redhat_1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"hornetq-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.25-4.SP11_redhat_1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.26-54.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.26-54.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.26-54.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.26-54.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.26-54.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jbcs-httpd24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1-3.jbcs.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jbcs-httpd24-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2h-4.jbcs.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jbcs-httpd24-openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2h-4.jbcs.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jbcs-httpd24-openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2h-4.jbcs.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jbcs-httpd24-openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2h-4.jbcs.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jbcs-httpd24-openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2h-4.jbcs.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jbcs-httpd24-openssl-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2h-4.jbcs.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jbcs-httpd24-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1-3.jbcs.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jbossas-hornetq-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.25-4.SP11_redhat_1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jbossas-jbossweb-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.34-5.redhat_1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"mod_cluster-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.13-3.Final_redhat_2.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"mod_cluster-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.13-3.Final_redhat_2.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"mod_jk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.41-2.redhat_4.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"mod_jk-ap22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.41-2.redhat_4.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"mod_jk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.41-2.redhat_4.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.26-54.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.26-54.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.34-5.redhat_1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"tomcat-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.34-5.redhat_1.ep6.el6"}]}],"bundled":3}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"redhat","product":"jboss_enterprise_application_platform"},{"vendor":"redhat","product":"jboss_enterprise_web_server"}],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2016-2056.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Broken Link","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1326320","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","web","report"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-1648.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory","web"]},{"url":"http://www.securityfocus.com/bid/92584","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2055.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-1649.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-1650.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Broken Link","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2054.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CX5QNNIVAUB2VVDV6TR3YMFTL6VRKOBO/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6JMA2YLPK6SEUVF5Q3QEANHYEPRZA2RI/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HE5YZTBZRXCMQFT5LDLZG2HAYBKMYQLL/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-3110","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6JMA2YLPK6SEUVF5Q3QEANHYEPRZA2RI","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CX5QNNIVAUB2VVDV6TR3YMFTL6VRKOBO","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HE5YZTBZRXCMQFT5LDLZG2HAYBKMYQLL","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6JMA2YLPK6SEUVF5Q3QEANHYEPRZA2RI","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CX5QNNIVAUB2VVDV6TR3YMFTL6VRKOBO","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HE5YZTBZRXCMQFT5LDLZG2HAYBKMYQLL","tags":["web"]},{"url":"https://web.archive.org/web/20200227231527/http://www.securityfocus.com/bid/92584","tags":["web"]},{"url":"https://github.com/advisories/GHSA-68qq-3phh-53j7"},{"url":"https://github.com/modcluster/mod_cluster","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2016:1648","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Web_Server/2.1/html/2.1.1_Release_Notes/index.html","tags":["article"]},{"url":"https://access.redhat.com/site/documentation/","tags":["article"]},{"url":"https://access.redhat.com/site/documentation/en-US/JBoss_Enterprise_Web_Server/2/html-single/Installation_Guide/index.html","tags":["article"]},{"url":"https://access.redhat.com/security/vulnerabilities/httpoxy","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1331441","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1331536","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1337155","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1337397","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1338646","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1353755","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1358118","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1648.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-2105","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-2105","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-2105","tags":["advisory"]},{"url":"https://openssl.org/news/secadv/20160503.txt","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-2106","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-2106","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-2106","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-3110","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-3110","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5387","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5387","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5387","tags":["advisory"]},{"url":"https://httpoxy.org/","tags":["article"]},{"url":"https://www.apache.org/security/asf-httpoxy-response.txt","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2016:1649","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1337396","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1366541","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1649.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2016:2054","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/articles/2688611","tags":["article"]},{"url":"https://access.redhat.com/solutions/222023","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-US/JBoss_Enterprise_Application_Platform/6.4/index.html","tags":["article"]},{"url":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=appplatform\u0026downloadType=securityPatches\u0026version=6.4","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1243887","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1341583","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1345989","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1345993","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1345997","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2054.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-3183","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-3183","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3183","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-4459","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-4459","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4459","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2016:2055","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1345987","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1345991","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1345995","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2055.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2016-3110","description":"mod_cluster, as used in Red Hat JBoss Web Server 2.1, allows remote attackers to cause a denial of service (Apache http server crash) via an MCMP message containing a series of = (equals) characters after a legitimate element.","status":"published","published":"2016-09-26T14:00:00Z","modified":"2024-08-05T23:47:57.125Z","updated_at":"2026-11-02T14:33:33.758954Z"}],"euvd":[{"id":"EUVD-2016-4163","description":"mod_cluster, as used in Red Hat JBoss Web Server 2.1, allows remote attackers to cause a denial of service (Apache http server crash) via an MCMP message containing a series of = (equals) characters after a legitimate element.","status":"published","published":"2016-09-26T14:00:00Z","modified":"2024-08-05T23:47:57Z","updated_at":"2026-11-03T02:22:51.132305Z"}],"ghsa":[{"id":"GHSA-68qq-3phh-53j7","title":"mod_cluster Denial of Service vulnerability","description":"mod_cluster, as used in Red Hat JBoss Web Server 2.1, allows remote attackers to cause a denial of service (Apache http server crash) via an MCMP message containing a series of = (equals) characters after a legitimate element.","status":"published","published":"2022-05-14T01:04:20Z","modified":"2025-04-14T21:46:56Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:38:39.85223Z"}],"nvd":[{"id":"CVE-2016-3110","description":"mod_cluster, as used in Red Hat JBoss Web Server 2.1, allows remote attackers to cause a denial of service (Apache http server crash) via an MCMP message containing a series of = (equals) characters after a legitimate element.","status":"published","published":"2016-09-26T14:59:00.147Z","modified":"2026-06-17T00:44:59.287Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:03:29.893676Z"}],"osv":[{"id":"GHSA-68qq-3phh-53j7","title":"mod_cluster Denial of Service vulnerability","description":"mod_cluster, as used in Red Hat JBoss Web Server 2.1, allows remote attackers to cause a denial of service (Apache http server crash) via an MCMP message containing a series of = (equals) characters after a legitimate element.","status":"published","published":"2022-05-14T01:04:20Z","modified":"2025-04-14T22:27:15.823877Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:39.266402Z"},{"id":"RHSA-2016:1648","title":"Red Hat Security Advisory: Red Hat JBoss Web Server 2.1.1 security update on RHEL 7","status":"published","published":"2024-09-15T23:25:01Z","modified":"2026-09-21T10:01:27Z","cvss":[{"version":"3.0","score":5.6,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:1649","title":"Red Hat Security Advisory: Red Hat JBoss Web Server 2.1.1 security update on RHEL 6","status":"published","published":"2024-09-15T23:25:07Z","modified":"2026-09-21T10:01:27Z","cvss":[{"version":"3.0","score":5.6,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:2054","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.10 natives update on RHEL 7","status":"published","published":"2024-09-15T23:27:42Z","modified":"2026-09-21T10:01:29Z","cvss":[{"version":"3.0","score":5.1,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:2055","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.10 natives update on RHEL 6","status":"published","published":"2024-09-15T23:27:37Z","modified":"2026-09-21T10:01:30Z","cvss":[{"version":"3.0","score":5.1,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:03.734507Z"}]}}