EUVD-2026-62367
GHSA-p4rg-ffff-6pmm
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Adjacent network required for multicast reachability; no authentication needed; only the advertise listener thread availability is impacted, with no confidentiality or integrity effects.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in mod_cluster's AdvertiseListenerImpl (org.jboss.modcluster core module). A single crafted UDP multicast datagram with a valid HTTP status line and a "Server:" header but without the "Date:", "Digest:", and "Sequence:" headers triggers a NullPointerException in verifyDigest() that is not caught by the worker thread's exception handler. This causes the advertise listener thread to terminate permanently. The failure is silent (isListening() continues to return true) and persists until the node is restarted. The crash occurs before the AdvertiseSecurityKey comparison, so deployments with a configured security key are still affected.
AnalysisAI
The AdvertiseListenerImpl component in mod_cluster's core multicast UDP handler can be permanently crashed by a single crafted datagram, affecting Red Hat JBoss Enterprise Application Platform 7 and 8, JBoss Web Server 5 through 7, and Red Hat Single Sign-On 7. An unauthenticated attacker with adjacency to the mod_cluster multicast group can silently terminate the advertise listener thread, causing the affected node to stop receiving cluster topology updates until manually restarted - with no runtime indication of failure since isListening() continues returning true. No public exploit is identified at time of analysis, and this CVE is not listed in the CISA KEV catalog based on available data.
Technical ContextAI
mod_cluster is a Red Hat JBoss component that uses UDP multicast datagrams for automatic cluster member advertisement and discovery, with AdvertiseListenerImpl receiving and processing those datagrams. The verifyDigest() method expects incoming messages to carry 'Date:', 'Digest:', and 'Sequence:' headers alongside the standard HTTP status line and 'Server:' header. When a datagram arrives with only the HTTP status line and 'Server:' header - and the three required headers are absent - verifyDigest() dereferences a null reference, raising an uncaught NullPointerException (CWE-476: NULL Pointer Dereference). This exception propagates out of the worker thread's exception handler, permanently terminating the listener thread. A significant design flaw compounds the impact: isListening() continues reporting true after the crash, creating a false health signal that defeats standard operational monitoring. The AdvertiseSecurityKey comparison - the intended protection against spoofed datagrams - is evaluated after the crash point, so nodes configured with a security key receive no additional protection against this specific attack vector.
RemediationAI
Apply the vendor-released patch from Red Hat when available; consult https://access.redhat.com/security/cve/CVE-2026-76166 and the associated Bugzilla entry at https://bugzilla.redhat.com/show_bug.cgi?id=2510883 for patched package versions, which are not confirmed in currently available data. As a primary compensating control, restrict UDP multicast traffic on mod_cluster's advertise port (default 23364, multicast group 224.0.1.105) to explicitly trusted source addresses using host-based iptables rules or network-level ACLs - note this requires maintaining an explicit allowlist of cluster member addresses and may disrupt dynamic cluster discovery. A stronger but more operationally significant workaround is to disable multicast advertisement entirely and configure mod_cluster with a static proxy list, which eliminates the UDP listener attack surface completely but requires manual cluster membership updates when nodes join or leave. Operators should also replace any reliance on isListening() in health checks with external verification of actual cluster topology synchronization, since that method returns false-positive health signals after the crash occurs.
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Unrestricted Java deserialization in Red Hat EAP's embedded Apache ActiveMQ Artemis broker allows authenticated JMS clie
Mismatched handling of the HTTP/1 absolute-form request authority in Red Hat build of Quarkus and other affected Red Hat
Access-control bypass in Keycloak (fixed in 26.5.3) lets a disabled user account still obtain valid tokens through the J
A remote, unauthenticated attacker can exhaust the JVM heap and cause a denial of service by sending a small crafted ima
Unbounded per-connection queue growth in Netty's WebSocketServerExtensionHandler lets unauthenticated remote attackers e
Improper handling of HTTP/2 and HTTP/3 Extended CONNECT requests in Netty-based services can downgrade them to ordinary
Unbounded remote-initiated stream creation in Netty's SpdySessionHandler allows an unauthenticated, network-positioned a
Unbounded heap memory consumption in Netty's HttpServerCodec (io.netty:netty-codec-http) lets a remote, unauthenticated
Denial-of-service in Undertow's WebSocket permessage-deflate implementation allows unauthenticated remote attackers to e
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today