Skip to content
Fencer Intel
high 7.5

CVE-2016-4459 json

Stack-based buffer overflow in native/mod_manager/node.c in mod_cluster 1.2.9.

published 2017-04-12 9 y ago modified 2026-06-17 4 mo ago also EUVD-2016-5448

cvss
7.5
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.7%
EPSS 2.7% chance of exploitation in 30 days, percentile 85%
public exploits
0
none known

Summary

Stack-based buffer overflow in native/mod_manager/node.c in mod_cluster 1.2.9.

Patch / fix

  • mod_jk jboss enterprise application platform 6 1.2.41-2.redhat_4.ep6.el7
  • httpd22 jboss enterprise application platform 6 2.2.26-56.ep6.el7
  • mod_ssl22 jboss enterprise application platform 6 1:2.2.26-56.ep6.el7
  • mod_ldap22 jboss enterprise application platform 6 2.2.26-56.ep6.el7
  • mod_jk-ap22 jboss enterprise application platform 6 1.2.41-2.redhat_4.ep6.el7
  • jbcs-httpd24 jboss enterprise application platform 6 1-3.jbcs.el7
  • httpd22-tools jboss enterprise application platform 6 2.2.26-56.ep6.el7
  • tomcat-native jboss enterprise application platform 6 1.1.34-5.redhat_1.ep6.el7

red hat advisories RHSA-2016:2054RHSA-2016:2055RHSA-2017:0194RHSA-2017:0193

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2016-4459 updated cvss 4.8

mod_cluster: Buffer overflow in mod_manager when sending request with long JVMRoute

  • Red Hat JBoss Enterprise Web Server 2 mod_cluster mod_cluster
    affected: no fix planned “Will not fix”
  • Red Hat JBoss Enterprise Web Server 3 mod_cluster mod_cluster
    affected: no fix available
  • Red Hat JBoss Core Services
    fixed: vendor fix RHSA-2016:2957
  • Red Hat JBoss Core Services on RHEL 6 Server jbcs-httpd24-httpd 2.4.23-102.jbcs.el6, jbcs-httpd24-nghttp2 1.12.0-9.jbcs.el6, jbcs-httpd24-openssl 1.0.2h-12.jbcs.el6, jbcs-httpd24-mod_rt 2.4.1-16.GA.jbcs.el6, jbcs-httpd24-mod_ssl 2.4.23-102.jbcs.el6, jbcs-httpd24-mod_bmx 0.9.6-14.GA.jbcs.el6, +21 more
    fixed: vendor fix RHSA-2017:0193
  • Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-httpd 2.4.23-102.jbcs.el7, jbcs-httpd24-nghttp2 1.12.0-9.jbcs.el7, jbcs-httpd24-openssl 1.0.2h-12.jbcs.el7, jbcs-httpd24-mod_rt 2.4.1-16.GA.jbcs.el7, jbcs-httpd24-mod_ssl 2.4.23-102.jbcs.el7, jbcs-httpd24-mod_bmx 0.9.6-14.GA.jbcs.el7, +19 more
    fixed: vendor fix RHSA-2017:0194
  • Red Hat JBoss Enterprise Application Platform 6.4
    fixed: vendor fix RHSA-2016:2056
  • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server httpd 2.2.26-54.ep6.el6, jbcs-httpd24 1-3.jbcs.el6, mod_ssl 2.2.26-54.ep6.el6, mod_ldap 2.2.26-54.ep6.el6, httpd-tools 2.2.26-54.ep6.el6, httpd-manual 2.2.26-54.ep6.el6, +11 more
    fixed: vendor fix RHSA-2016:2055
  • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server httpd22 2.2.26-56.ep6.el7, jbcs-httpd24 1-3.jbcs.el7, mod_ssl22 2.2.26-56.ep6.el7, mod_ldap22 2.2.26-56.ep6.el7, httpd22-tools 2.2.26-56.ep6.el7, httpd22-manual 2.2.26-56.ep6.el7, +11 more
    fixed: vendor fix RHSA-2016:2054

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.67% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.0 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 7.8 AV:N/AC:L/Au:N/C:N/I:N/A:C

Classification

Weakness
  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.