CVE-2026-76166

Name of the Vulnerable Software and Affected Versions mod cluster (affected versions not specified)

Description A flaw exists in the AdvertiseListenerImpl of the org.jboss.modcluster core module. An unauthenticated attacker can cause a denial of service by sending a single crafted UDP multicast datagram. The datagram must contain a valid HTTP status line and a Server: header, but omit the Date:, Digest:, and Sequence: headers. This triggers a NullPointerException within the verifyDigest() function that is not caught by the worker thread exception handler, leading to the permanent termination of the advertise listener thread. The failure is silent, as isListening() continues to return true, and the service remains unavailable until the node is restarted. This issue affects deployments regardless of whether an AdvertiseSecurityKey is configured, as the crash occurs before the security key comparison.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.