EUVD-2026-62367
GHSA-p4rg-ffff-6pmm
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Adjacent network required for multicast reachability; no authentication needed; only the advertise listener thread availability is impacted, with no confidentiality or integrity effects.
Primary rating from Vendor (redhat).
CVSS VectorNVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Lifecycle Timeline
1DescriptionNVD
A flaw was found in mod_cluster's AdvertiseListenerImpl (org.jboss.modcluster core module). A single crafted UDP multicast datagram with a valid HTTP status line and a "Server:" header but without the "Date:", "Digest:", and "Sequence:" headers triggers a NullPointerException in verifyDigest() that is not caught by the worker thread's exception handler. This causes the advertise listener thread to terminate permanently. The failure is silent (isListening() continues to return true) and persists until the node is restarted. The crash occurs before the AdvertiseSecurityKey comparison, so deployments with a configured security key are still affected.
AnalysisAI
The AdvertiseListenerImpl component in mod_cluster's core multicast UDP handler can be permanently crashed by a single crafted datagram, affecting Red Hat JBoss Enterprise Application Platform 7 and 8, JBoss Web Server 5 through 7, and Red Hat Single Sign-On 7. An unauthenticated attacker with adjacency to the mod_cluster multicast group can silently terminate the advertise listener thread, causing the affected node to stop receiving cluster topology updates until manually restarted - with no runtime indication of failure since isListening() continues returning true. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The mod_cluster advertise listener (AdvertiseListenerImpl) must be active and listening for UDP multicast datagrams - this is the default cluster discovery mode when mod_cluster advertisement is enabled in the deployment configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS base score of 4.3 with an adjacent network vector (AV:A) accurately reflects that exploitation requires the attacker to be co-located on the same multicast domain, substantially limiting the Internet-exposed attack surface. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker co-located on the same network multicast domain sends a single UDP datagram addressed to mod_cluster's advertise multicast group, containing a valid HTTP status line and a 'Server:' header but deliberately omitting the 'Date:', 'Digest:', and 'Sequence:' headers. This triggers a NullPointerException in verifyDigest() that escapes the worker thread's exception handler, permanently terminating the advertise listener thread. … |
| Remediation | Apply the vendor-released patch from Red Hat when available; consult https://access.redhat.com/security/cve/CVE-2026-76166 and the associated Bugzilla entry at https://bugzilla.redhat.com/show_bug.cgi?id=2510883 for patched package versions, which are not confirmed in currently available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Unrestricted archive upload in WildFly Core enables authenticated 'deployer' role users to deploy malicious Java archive
Cross-site scripting in Jastow - the JSP implementation layer embedded within Red Hat JBoss Enterprise Application Platf
HTTP request smuggling in Undertow's ChunkReader component enables unauthenticated remote attackers to inject out-of-syn
Undertow's HTTP response header writing path silently truncates 16-bit Unicode characters to 8-bit bytes via a narrowing
Denial of service in WildFly Core (and downstream Red Hat middleware products) allows a remote administrative user to re
Path traversal in WildFly's domain mode LocalFileRepository exposes arbitrary files readable by the Domain Controller pr
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Null Pointer Dereference
View allShare
External POC / Exploit Code
Leaving vuln.today