mod_cluster AdvertiseListener NullPointerException via UDP Multicast
CVE-2026-76166 Published on August 19, 2026

Modcluster-core: mod_cluster advertise listener: unauthenticated dos via crafted multicast datagram
A flaw was found in mod_cluster's AdvertiseListenerImpl (org.jboss.modcluster core module). A single crafted UDP multicast datagram with a valid HTTP status line and a "Server:" header but without the "Date:", "Digest:", and "Sequence:" headers triggers a NullPointerException in verifyDigest() that is not caught by the worker thread's exception handler. This causes the advertise listener thread to terminate permanently. The failure is silent (isListening() continues to return true) and persists until the node is restarted. The crash occurs before the AdvertiseSecurityKey comparison, so deployments with a configured security key are still affected.

NVD

Vulnerability Analysis

Attack Vector:
ADJACENT_NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
NONE
Integrity Impact:
NONE
Availability Impact:
LOW

Timeline

Reported to Red Hat.

Made public. 12 days later.

Weakness Type

NULL Pointer Dereference

A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. NULL pointer dereference issues can occur through a number of flaws, including race conditions, and simple programming omissions.


Products Associated with CVE-2026-76166

Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.

Red Hat Jboss Enterprise Application Platform
 
Red Hat Jbosseapxp
 
Red Hat Jboss Enterprise Web Server
 
Red Hat Single Sign On
 

Affected Versions

Red Hat JBoss Enterprise Application Platform 7: Red Hat JBoss Enterprise Application Platform 8: Red Hat JBoss Enterprise Application Platform Expansion Pack: Red Hat JBoss Web Server 5: Red Hat JBoss Web Server 6: Red Hat JBoss Web Server 7: Red Hat Single Sign-On 7: