Skip to content
Fencer Vulns
medium 4.3

CVE-2026-76166 json

Modcluster-core: mod_cluster advertise listener: unauthenticated dos via crafted multicast datagram

published 2026-08-19 2 mo ago modified 2026-11-03 5 d ago also EUVD-2026-62367

cvss
4.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.7%
EPSS 2.7% chance of exploitation in 30 days, percentile 86%
public exploits
0
none known

Summary

A flaw was found in mod_cluster's AdvertiseListenerImpl (org.jboss.modcluster core module). A single crafted UDP multicast datagram with a valid HTTP status line and a "Server:" header but without the "Date:", "Digest:", and "Sequence:" headers triggers a NullPointerException in verifyDigest() that is not caught by the worker thread's exception handler. This causes the advertise listener thread to terminate permanently. The failure is silent (isListening() continues to return true) and persists until the node is restarted. The crash occurs before the AdvertiseSecurityKey comparison, so deployments with a configured security key are still affected.

Patch / fix

  • Red Hat Red Hat JBoss Web Server 7.0 on RHEL 10 0:1.3.7-4.redhat_4.el10jws, 0:2.1.1-1.Final_redhat_00001.1.el10jws, 0:11.0.21-10.redhat_00010.1.el10jws
  • Red Hat Red Hat JBoss Web Server 7.0 on RHEL 8 0:1.3.7-4.redhat_4.el8jws, 0:2.1.1-1.Final_redhat_00001.1.el8jws, 0:11.0.21-10.redhat_00010.1.el8jws
  • Red Hat Red Hat JBoss Web Server 7.0 on RHEL 9 0:1.3.7-4.redhat_4.el9jws, 0:2.1.1-1.Final_redhat_00001.1.el9jws, 0:11.0.21-10.redhat_00010.1.el9jws

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-76166 updated cvss 4.3

modcluster-core: mod_cluster Advertise Listener: unauthenticated DoS via crafted multicast datagram

  • Red Hat JBoss Enterprise Application Platform 7 mod_cluster-core 1.4.5.Final-redhat-00001 Red Hat JBoss Enterprise Application Platform 8 mod_cluster-core 1.4.5.Final-redhat-00001 Red Hat JBoss Enterprise Application Platform Expansion Pack mod_cluster-core 1.4.5.Final-redhat-00001
    affected: workaround, no fix available “Fix deferred”
  • Red Hat JBoss Web Server 5 mod_cluster-core 1.4.5.Final-redhat-00001
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat JBoss Web Server 6 mod_cluster-core 1.4.5.Final-redhat-00001
    affected: workaround, no fix available
  • Red Hat Single Sign-On 7 mod_cluster-core 1.4.5.Final-redhat-00001
    affected: workaround, no fix available “Fix deferred”
  • Red Hat JBoss Web Server 7.0 on RHEL 8 jws7-tomcat-native 1.3.7-4.redhat_4.el8jws, jws7-tomcat 11.0.21-10.redhat_00010.1.el8jws, jws7-tomcat-lib 11.0.21-10.redhat_00010.1.el8jws, jws7-mod_cluster 2.1.1-1.Final_redhat_00001.1.el8jws, jws7-tomcat-javadoc 11.0.21-10.redhat_00010.1.el8jws, jws7-tomcat-selinux 11.0.21-10.redhat_00010.1.el8jws, +7 more Red Hat JBoss Web Server 7.0 on RHEL 9 jws7-tomcat-native 1.3.7-4.redhat_4.el9jws, jws7-tomcat 11.0.21-10.redhat_00010.1.el9jws, jws7-tomcat-lib 11.0.21-10.redhat_00010.1.el9jws, jws7-mod_cluster 2.1.1-1.Final_redhat_00001.1.el9jws, jws7-tomcat-javadoc 11.0.21-10.redhat_00010.1.el9jws, jws7-tomcat-selinux 11.0.21-10.redhat_00010.1.el9jws, +7 more Red Hat JBoss Web Server 7.0 on RHEL 10 jws7-tomcat-native 1.3.7-4.redhat_4.el10jws, jws7-tomcat 11.0.21-10.redhat_00010.1.el10jws, jws7-tomcat-lib 11.0.21-10.redhat_00010.1.el10jws, jws7-mod_cluster 2.1.1-1.Final_redhat_00001.1.el10jws, jws7-tomcat-javadoc 11.0.21-10.redhat_00010.1.el10jws, jws7-tomcat-selinux 11.0.21-10.redhat_00010.1.el10jws, +7 more
    fixed: vendor fix RHSA-2026:93618
  • Red Hat JBoss Web Server 7.0.3
    fixed: vendor fix RHSA-2026:93622

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 mo ago

Exploit prediction

2.72% chance of exploitation in the next 30 days, higher than 86% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

  • Red Hat Red Hat JBoss Web Server 7.0.3
  • Red Hat Red Hat JBoss Web Server 7.0 on RHEL 10
  • Red Hat Red Hat JBoss Web Server 7.0 on RHEL 8
  • Red Hat Red Hat JBoss Web Server 7.0 on RHEL 9
  • Red Hat Red Hat JBoss Enterprise Application Platform 7
  • Red Hat Red Hat JBoss Enterprise Application Platform 8
  • Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Red Hat JBoss Web Server 5
  • Red Hat Red Hat JBoss Web Server 6
  • Red Hat Red Hat Single Sign-On 7

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.