NullPointerException in mod_cluster's AdvertiseListenerImpl Affects Red Hat
CVE-2026-76166

4.3MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Jboss Enterprise Application Platform 7
Red Hat Jboss Enterprise Application Platform 8
Red Hat Jboss Enterprise Application Platform Expansion Pack
Red Hat Jboss Web Server 5
Vendor
CVE Published:
19 August 2026

What is CVE-2026-76166?

A vulnerability exists in mod_cluster's AdvertiseListenerImpl, where a crafted UDP multicast datagram lacking specific headers leads to a silent NullPointerException. This exception is uncaught by the worker thread's handler, causing the advertise listener thread to crash indefinitely. Although the isListening() function continues to affirm that the service is operational, the component fails until the server is restarted. This issue affects all deployments configured with a security key, as it occurs before any AdvertiseSecurityKey validations.

References

https://access.redhat.com/security/cve/CVE-2026-76166
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2510883
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Kien Pham (Ninh Thanh Cyber Security (NTCS)) and Ta Duc Thien (Ninh Thanh Cyber Security (NTCS)) for reporting this issue.
.