Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.3
CVE-2026-76166: Apache mod_cluster: Denial of Service via Malformed Multicast Packet
CVE-2026-76166 · published 2 months ago
Summary
A flaw in Apache mod_cluster allows an attacker to crash the service, making it unavailable until restarted. This can be exploited by sending a specially crafted packet, which can be done without needing a password or authentication. Affected administrators should update their mod_cluster service to the latest version to prevent this issue.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| red hat | red hat jboss enterprise application platform 7 | All versions |
| red hat | red hat jboss enterprise application platform 8 | All versions |
| red hat | red hat jboss enterprise application platform expansion pack | All versions |
| red hat | red hat jboss web server 5 | All versions |
| red hat | red hat jboss web server 6 | All versions |
| red hat | red hat jboss web server 7 | All versions |
| red hat | red hat single sign-on 7 | All versions |
| red hat | red hat jboss web server 7.0.3 | All versions |
| red hat | red hat jboss web server 7.0 on rhel 10 | All versions |
| red hat | red hat jboss web server 7.0 on rhel 8 | All versions |
| red hat | red hat jboss web server 7.0 on rhel 9 | All versions |
Original advisory text
Modcluster-core: mod_cluster advertise listener: unauthenticated dos via crafted multicast datagram
A flaw was found in mod_cluster's AdvertiseListenerImpl (org.jboss.modcluster core module). A single crafted UDP multicast datagram with a valid HTTP status line and a "Server:" header but without the "Date:", "Digest:", and "Sequence:" headers triggers a NullPointerException in verifyDigest() that is not caught by the worker thread's exception handler. This causes the advertise listener thread to terminate permanently. The failure is silent (isListening() continues to return true) and persists until the node is restarted. The crash occurs before the AdvertiseSecurityKey comparison, so deployments with a configured security key are still affected.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-476NULL Pointer Dereference
Timeline
Published19 Aug 2026
Updated4 Nov 2026
First seen19 Aug 2026
Track software like this
Free during beta