Skip to content
Fencer Intel
critical 9.8

CVE-2016-2141 json

Improper Input Validation in JGroups

published 2016-06-30 10 y ago modified 2026-06-17 4 mo ago also EUVD-2022-5146 , GHSA-rc7h-x6cq-988q

cvss
9.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
4.7%
EPSS 4.7% chance of exploitation in 30 days, percentile 91%
public exploits
0
none known

Summary

It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information disclosure, message spoofing, or further possible attacks.

Patch / fix

  • maven org.jgroups:jgroups 3.2.16.Final, 3.6.10.Final
  • org.jgroups jgroups 3.2.16.Final, 3.6.10.Final
  • redhat jgroups 3.2.16.Final, 3.6.10.Final
  • jboss-ec2-eap jboss enterprise application platform 6 7.5.9-2.Final_redhat_2.ep6.el6
  • jboss-ec2-eap-samples jboss enterprise application platform 6 7.5.9-2.Final_redhat_2.ep6.el6
  • jgroups jboss enterprise application platform 5 1:2.6.22-2.ep5.el4
  • jgroups jboss enterprise application platform 5 1:2.6.22-2.ep5.el5
  • jgroups jboss enterprise application platform 5 1:2.6.22-2.ep5.el6
  • hornetq jboss enterprise application platform 6 2.3.25-13.SP11_redhat_1.1.ep6.el7
  • jbossts jboss enterprise application platform 6 1:4.17.34-1.Final_redhat_1.1.ep6.el7
  • jbossweb jboss enterprise application platform 6 7.5.17-1.Final_redhat_1.1.ep6.el7

red hat advisories RHSA-2016:1432RHSA-2016:1328RHSA-2016:1434RHSA-2016:1433RHSA-2016:1330RHSA-2016:1332

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2016-2141 updated cvss 9.8

JGroups: Authorization bypass

  • Red Hat BPM Suite 6 Clustering Clustering Red Hat JBoss BRMS 6 Clustering Clustering Red Hat JBoss Fuse 6 camel Red Hat Single Sign-On 7 Clustering Clustering
    affected: workaround, no fix available “Please refer to https://access.redhat.com/articles/2360521 for more information.”
  • Red Hat JBoss Enterprise BRMS Platform 5.3
    fixed: vendor fix “Please refer to https://access.redhat.com/articles/2360521 for more information.” RHSA-2016:1345
  • Red Hat JBoss BRMS 6.3
    fixed: vendor fix “Please refer to https://access.redhat.com/articles/2360521 for more information.” RHSA-2016:1347
  • Red Hat JBoss Data Grid 6.6
    fixed: vendor fix “Please refer to https://access.redhat.com/articles/2360521 for more information.” RHSA-2016:1334
  • Red Hat JBoss Data Virtualization 6.2
    fixed: vendor fix “Please refer to https://access.redhat.com/articles/2360521 for more information.” RHSA-2016:1346
  • Red Hat JBoss EAP 7.0
    fixed: vendor fix “Please refer to https://access.redhat.com/articles/2360521 for more information.” RHSA-2016:1333
  • Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS jgroups 2.6.22-2.ep5.el4 Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES jgroups 2.6.22-2.ep5.el4 Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server jgroups 2.6.22-2.ep5.el5 Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server jgroups 2.6.22-2.ep5.el6
    fixed: vendor fix “Please refer to https://access.redhat.com/articles/2360521 for more information.” RHSA-2016:1328
  • Red Hat JBoss Enterprise Application Platform 5.2
    fixed: vendor fix “Please refer to https://access.redhat.com/articles/2360521 for more information.” RHSA-2016:1329
show 9 more
  • Red Hat JBoss Enterprise Application Platform 6.4
    fixed: vendor fix “Please refer to https://access.redhat.com/articles/2360521 for more information.” RHSA-2016:1435
  • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 Server jgroups 3.2.16-1.Final_redhat_1.1.ep6.el5 Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server hornetq 2.3.25-13.SP11_redhat_1.1.ep6.el6, jgroups 3.2.16-1.Final_redhat_1.1.ep6.el6, apache-cxf 2.7.18-2.SP1_redhat_1.1.ep6.el6, jboss-msc 1.1.6-1.Final_redhat_1.1.ep6.el6, jbossts 4.17.34-1.Final_redhat_1.1.ep6.el6, jbossweb 7.5.17-1.Final_redhat_1.1.ep6.el6, +71 more Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server hornetq 2.3.25-13.SP11_redhat_1.1.ep6.el7, jgroups 3.2.16-1.Final_redhat_1.1.ep6.el7, apache-cxf 2.7.18-2.SP1_redhat_1.1.ep6.el7, jboss-msc 1.1.6-1.Final_redhat_1.1.ep6.el7, jbossts 4.17.34-1.Final_redhat_1.1.ep6.el7, jbossweb 7.5.17-1.Final_redhat_1.1.ep6.el7, +69 more
    fixed: vendor fix “Please refer to https://access.redhat.com/articles/2360521 for more information.” RHSA-2016:1330
  • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server eap7-jgroups 3.6.8-3.Final_redhat_3.1.ep7.el6 Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server eap7-jgroups 3.6.8-3.Final_redhat_3.1.ep7.el7
    fixed: vendor fix “Please refer to https://access.redhat.com/articles/2360521 for more information.” RHSA-2016:1332
  • Red Hat JBoss Fuse 6.3
    fixed: vendor fix “Please refer to https://access.redhat.com/articles/2360521 for more information.” RHSA-2016:2035
  • Red Hat JBoss Fuse Service Works 6.0
    fixed: vendor fix “Please refer to https://access.redhat.com/articles/2360521 for more information.” RHSA-2016:1389
  • Red Hat JBoss Portal 6.2
    fixed: vendor fix “Please refer to https://access.redhat.com/articles/2360521 for more information.” RHSA-2016:1374
  • Red Hat JBoss SOA Platform 5.3
    fixed: vendor fix “Please refer to https://access.redhat.com/articles/2360521 for more information.” RHSA-2016:1376
  • Red Hat Single Sign-On 7.0
    fixed: vendor fix “Please refer to https://access.redhat.com/articles/2360521 for more information.” RHSA-2016:1439
  • Red Hat AMQ Broker 7 jgroups Red Hat Enterprise Virtualization 3 distribution Red Hat Fuse 7 camel
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

4.70% chance of exploitation in the next 30 days, higher than 91% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
GitHub 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected packages

ecosystem package affected fixed in
maven org.jgroups:jgroups
>=3.3.0.Alpha1, <3.6.10.Final
<3.2.16.Final
3.6.10.Final
3.2.16.Final

Classification

Weakness
  • CWE-20 Improper Input Validation

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Add correct affected ranges per https://github.com/advisories/GHSA-rc7h-x6cq-988q.