Bug 2510883 (CVE-2026-76166) - CVE-2026-76166 modcluster-core: mod_cluster Advertise Listener: unauthenticated DoS via crafted multicast datagram
Summary: CVE-2026-76166 modcluster-core: mod_cluster Advertise Listener: unauthenticat...
Keywords:
Status: NEW
Alias: CVE-2026-76166
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-04 04:37 UTC by OSIDB Bzimport
Modified: 2026-08-19 09:19 UTC (History)
35 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-08-04 04:37:34 UTC 
Reported via PSIRTSUPT-20286 by Ta Duc Thien from Ninh Thanh Cyber Security (NTCS).

Vulnerability in org.jboss.modcluster core module, class AdvertiseListenerImpl. A crafted UDP multicast datagram (missing Date/Digest/Sequence headers) triggers an uncaught NullPointerException in verifyDigest() that kills the advertise worker thread permanently. Works even with AdvertiseSecurityKey configured (NPE fires before key comparison). Silent failure — isListening() keeps returning true.

Upstream: https://github.com/modcluster/mod_cluster
Affected version: 2.1.0.Final (confirmed by reporter, same code on current main branch)
Reporter's PoC and full write-up attached to PSIRTSUPT-20286.
Note You need to log in before you can comment on or make changes to this bug.