Skip to content
Fencer Intel
medium 4.3

CVE-2026-76166 json

Modcluster-core: mod_cluster advertise listener: unauthenticated dos via crafted multicast datagram

published 2mo ago modified 2d ago also EUVD-2026-62367

cvss
4.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.4%
EPSS 2.4% chance of exploitation in 30 days, percentile 84%
public exploits
0
none known

Summary

A flaw was found in mod_cluster's AdvertiseListenerImpl (org.jboss.modcluster core module). A single crafted UDP multicast datagram with a valid HTTP status line and a "Server:" header but without the "Date:", "Digest:", and "Sequence:" headers triggers a NullPointerException in verifyDigest() that is not caught by the worker thread's exception handler. This causes the advertise listener thread to terminate permanently. The failure is silent (isListening() continues to return true) and persists until the node is restarted. The crash occurs before the AdvertiseSecurityKey comparison, so deployments with a configured security key are still affected.

Patch / fix

  • Red Hat Red Hat JBoss Web Server 6.2 on RHEL 10 0:1.3.6-2.redhat_2.el10jws, 0:2.0.5-1.Final_redhat_00001.1.el10jws, 0:10.1.49-18.redhat_00018.1.el10jws
  • Red Hat Red Hat JBoss Web Server 6.2 on RHEL 8 0:1.3.6-2.redhat_2.el8jws, 0:2.0.5-1.Final_redhat_00001.1.el8jws, 0:10.1.49-18.redhat_00018.1.el8jws
  • Red Hat Red Hat JBoss Web Server 6.2 on RHEL 9 0:1.3.6-2.redhat_2.el9jws, 0:2.0.5-1.Final_redhat_00001.1.el9jws, 0:10.1.49-18.redhat_00018.1.el9jws
  • Red Hat Red Hat JBoss Web Server 7.0 on RHEL 10 0:1.3.7-4.redhat_4.el10jws, 0:2.1.1-1.Final_redhat_00001.1.el10jws, 0:11.0.21-10.redhat_00010.1.el10jws
  • Red Hat Red Hat JBoss Web Server 7.0 on RHEL 8 0:1.3.7-4.redhat_4.el8jws, 0:2.1.1-1.Final_redhat_00001.1.el8jws, 0:11.0.21-10.redhat_00010.1.el8jws
  • Red Hat Red Hat JBoss Web Server 7.0 on RHEL 9 0:1.3.7-4.redhat_4.el9jws, 0:2.1.1-1.Final_redhat_00001.1.el9jws, 0:11.0.21-10.redhat_00010.1.el9jws

Is CVE-2026-76166 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-76166 updated cvss 4.3

modcluster-core: mod_cluster Advertise Listener: unauthenticated DoS via crafted multicast datagram

  • Red Hat JBoss Enterprise Application Platform 7 mod_cluster-core 1.4.5.Final-redhat-00001 Red Hat JBoss Enterprise Application Platform 8 mod_cluster-core 1.4.5.Final-redhat-00001 Red Hat JBoss Enterprise Application Platform Expansion Pack mod_cluster-core 1.4.5.Final-redhat-00001
    affected: workaround, no fix available “Fix deferred”
  • Red Hat JBoss Web Server 5 mod_cluster-core 1.4.5.Final-redhat-00001
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Single Sign-On 7 mod_cluster-core 1.4.5.Final-redhat-00001
    affected: workaround, no fix available “Fix deferred”
  • Red Hat JBoss Web Server 6.2 on RHEL 8 jws6-tomcat-native 1.3.6-2.redhat_2.el8jws, jws6-tomcat 10.1.49-18.redhat_00018.1.el8jws, jws6-tomcat-lib 10.1.49-18.redhat_00018.1.el8jws, jws6-mod_cluster 2.0.5-1.Final_redhat_00001.1.el8jws, jws6-tomcat-javadoc 10.1.49-18.redhat_00018.1.el8jws, jws6-tomcat-selinux 10.1.49-18.redhat_00018.1.el8jws, +7 more Red Hat JBoss Web Server 6.2 on RHEL 9 jws6-tomcat-native 1.3.6-2.redhat_2.el9jws, jws6-tomcat 10.1.49-18.redhat_00018.1.el9jws, jws6-tomcat-lib 10.1.49-18.redhat_00018.1.el9jws, jws6-mod_cluster 2.0.5-1.Final_redhat_00001.1.el9jws, jws6-tomcat-javadoc 10.1.49-18.redhat_00018.1.el9jws, jws6-tomcat-selinux 10.1.49-18.redhat_00018.1.el9jws, +7 more Red Hat JBoss Web Server 6.2 on RHEL 10 jws6-tomcat-native 1.3.6-2.redhat_2.el10jws, jws6-tomcat 10.1.49-18.redhat_00018.1.el10jws, jws6-tomcat-lib 10.1.49-18.redhat_00018.1.el10jws, jws6-mod_cluster 2.0.5-1.Final_redhat_00001.1.el10jws, jws6-tomcat-javadoc 10.1.49-18.redhat_00018.1.el10jws, jws6-tomcat-selinux 10.1.49-18.redhat_00018.1.el10jws, +7 more
    fixed: vendor fix RHSA-2026:96228
  • Red Hat JBoss Web Server 6.2.6
    fixed: vendor fix RHSA-2026:96229
  • Red Hat JBoss Web Server 7.0 on RHEL 8 jws7-tomcat-native 1.3.7-4.redhat_4.el8jws, jws7-tomcat 11.0.21-10.redhat_00010.1.el8jws, jws7-tomcat-lib 11.0.21-10.redhat_00010.1.el8jws, jws7-mod_cluster 2.1.1-1.Final_redhat_00001.1.el8jws, jws7-tomcat-javadoc 11.0.21-10.redhat_00010.1.el8jws, jws7-tomcat-selinux 11.0.21-10.redhat_00010.1.el8jws, +7 more Red Hat JBoss Web Server 7.0 on RHEL 9 jws7-tomcat-native 1.3.7-4.redhat_4.el9jws, jws7-tomcat 11.0.21-10.redhat_00010.1.el9jws, jws7-tomcat-lib 11.0.21-10.redhat_00010.1.el9jws, jws7-mod_cluster 2.1.1-1.Final_redhat_00001.1.el9jws, jws7-tomcat-javadoc 11.0.21-10.redhat_00010.1.el9jws, jws7-tomcat-selinux 11.0.21-10.redhat_00010.1.el9jws, +7 more Red Hat JBoss Web Server 7.0 on RHEL 10 jws7-tomcat-native 1.3.7-4.redhat_4.el10jws, jws7-tomcat 11.0.21-10.redhat_00010.1.el10jws, jws7-tomcat-lib 11.0.21-10.redhat_00010.1.el10jws, jws7-mod_cluster 2.1.1-1.Final_redhat_00001.1.el10jws, jws7-tomcat-javadoc 11.0.21-10.redhat_00010.1.el10jws, jws7-tomcat-selinux 11.0.21-10.redhat_00010.1.el10jws, +7 more
    fixed: vendor fix RHSA-2026:93618
  • Red Hat JBoss Web Server 7.0.3
    fixed: vendor fix RHSA-2026:93622

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2mo ago

Exploit prediction

2.40% chance of exploitation in the next 30 days, higher than 84% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by version score vector
CNA 3.1 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

  • Red Hat Red Hat JBoss Web Server 6.2.6
  • Red Hat Red Hat JBoss Web Server 6.2 on RHEL 10
  • Red Hat Red Hat JBoss Web Server 6.2 on RHEL 8
  • Red Hat Red Hat JBoss Web Server 6.2 on RHEL 9
  • Red Hat Red Hat JBoss Web Server 7.0.3
  • Red Hat Red Hat JBoss Web Server 7.0 on RHEL 10
  • Red Hat Red Hat JBoss Web Server 7.0 on RHEL 8
  • Red Hat Red Hat JBoss Web Server 7.0 on RHEL 9
  • Red Hat Red Hat JBoss Enterprise Application Platform 7
  • Red Hat Red Hat JBoss Enterprise Application Platform 8
  • Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Red Hat JBoss Web Server 5
  • Red Hat Red Hat Single Sign-On 7

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.