CVE-2026-76166

Awaiting Analysis Awaiting Analysis - Queue

Heap Overflow in mod_cluster AdvertiseListenerImpl

Publication date: 2026-08-19

Last updated on: 2026-08-20

Assigner: redhat-SADP

Description

A flaw was found in mod_cluster's AdvertiseListenerImpl (org.jboss.modcluster core module). A single crafted UDP multicast datagram with a valid HTTP status line and a "Server:" header but without the "Date:", "Digest:", and "Sequence:" headers triggers a NullPointerException in verifyDigest() that is not caught by the worker thread's exception handler. This causes the advertise listener thread to terminate permanently. The failure is silent (isListening() continues to return true) and persists until the node is restarted. The crash occurs before the AdvertiseSecurityKey comparison, so deployments with a configured security key are still affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-20

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-76166

EUVD

EUVD-2026-62367

Affected Vendors & Products

Vendor	Product	Version / Range
redhat	mod_cluster	From 2.1.0.final (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This vulnerability is in mod_cluster's AdvertiseListenerImpl component. A specially crafted UDP multicast datagram without required headers (Date, Digest, Sequence) causes a NullPointerException in verifyDigest() that crashes the advertise listener thread permanently. The crash is silent and persists until node restart.

Detection Guidance

Monitor the mod_cluster AdvertiseListenerImpl thread status. Check if isListening() returns true but the thread is not processing advertisements. Inspect network traffic for unexpected UDP multicast packets on port 23364 (default) targeting 224.0.1.105. Verify logs for NullPointerException errors in the mod_cluster module.

Impact Analysis

The vulnerability causes a denial-of-service condition by terminating the advertise listener thread. This disrupts cluster communication and proxy advertisement functionality. The impact is silent but persistent until the affected node is restarted.

Compliance Impact

This vulnerability causes a denial-of-service condition by crashing the advertise listener thread, which could lead to service unavailability. For GDPR, this may impact data processing operations requiring continuous availability. For HIPAA, it could disrupt critical healthcare services dependent on mod_cluster functionality.

Mitigation Strategies

Disable multicast-based proxy advertisement and switch to static proxy configuration. If multicast is required, isolate the multicast network segment (224.0.1.105:23364) from untrusted networks. Restart affected nodes to ensure the AdvertiseListenerImpl thread is running correctly.

Hi! I’m here to help you understand CVE-2026-76166. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70