CVE-2026-76166 Overview
CVE-2026-76166 is a null pointer dereference vulnerability [CWE-476] in the AdvertiseListenerImpl class of the mod_cluster org.jboss.modcluster core module. A single crafted UDP multicast datagram can permanently terminate the advertise listener thread. The datagram must contain a valid HTTP status line and a Server: header while omitting the Date:, Digest:, and Sequence: headers. This omission triggers a NullPointerException in verifyDigest() that the worker thread's exception handler does not catch.
Critical Impact
A single unauthenticated adjacent-network packet silently kills the advertise listener until the node is restarted, breaking cluster node discovery even when an AdvertiseSecurityKey is configured.
Affected Products
- mod_cluster org.jboss.modcluster core module
- Deployments using AdvertiseListenerImpl for UDP multicast advertisement
- Red Hat products bundling the affected mod_cluster core module
Discovery Timeline
- 2026-08-19 - CVE-2026-76166 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-76166
Vulnerability Analysis
The mod_cluster advertise listener consumes UDP multicast datagrams that advertise backend node availability. The AdvertiseListenerImpl worker thread parses each datagram's HTTP-style headers and passes them to verifyDigest() for integrity validation. The parser accepts a datagram as structurally valid when it contains an HTTP status line and a Server: header. However, verifyDigest() dereferences the Date:, Digest:, and Sequence: header values without null checks.
When an attacker sends a datagram containing only the status line and Server: header, verifyDigest() reads null references and throws a NullPointerException. The worker thread's exception handler does not catch this specific exception, so the thread terminates. The advertise listener enters a silent failure state: isListening() continues to return true, yet no further advertisements are processed. Recovery requires a full node restart.
The crash occurs before the AdvertiseSecurityKey comparison. Deployments that rely on a configured security key for message authentication receive no protection from this flaw. Impact is limited to availability of the cluster discovery mechanism, with no direct confidentiality or integrity loss.
Root Cause
The root cause is missing null validation in verifyDigest() combined with an incomplete worker thread exception handler. Header lookup returns null for absent fields, and the code path assumes their presence based on earlier structural checks.
Attack Vector
Exploitation requires the attacker to send a single crafted UDP multicast datagram reachable by the advertise listener. This constrains the attacker to the adjacent network segment carrying the multicast group. No authentication or user interaction is required. Refer to the Red Hat CVE-2026-76166 Advisory and Red Hat Bug Report #2510883 for vendor technical details.
Detection Methods for CVE-2026-76166
Indicators of Compromise
- Unexpected termination entries or NullPointerException stack traces referencing AdvertiseListenerImpl or verifyDigest in JBoss or WildFly server logs.
- Cluster nodes disappearing from the proxy's node table while isListening() continues to report the listener as active.
- Inbound UDP multicast datagrams to the mod_cluster advertise group containing only an HTTP status line and a Server: header.
Detection Strategies
- Correlate mod_cluster worker thread exit events with subsequent gaps in node advertisement traffic on the multicast group.
- Inspect UDP multicast payloads on the advertise port for HTTP-like messages missing the Date:, Digest:, or Sequence: headers.
- Add active health checks that verify advertise traffic is being received, rather than relying on the isListening() status.
Monitoring Recommendations
- Alert on any NullPointerException originating in org.jboss.modcluster.advertise packages.
- Track the count of advertised nodes over time and alert on sudden drops to zero.
- Log and review all UDP traffic destined for the mod_cluster multicast address at the network layer.
How to Mitigate CVE-2026-76166
Immediate Actions Required
- Restrict the advertise multicast group to trusted network segments using switch-level multicast filtering or VLAN isolation.
- Restart any JBoss, WildFly, or mod_cluster node whose advertise listener has silently stopped processing datagrams.
- Apply vendor patches referenced in the Red Hat CVE-2026-76166 Advisory as soon as they are available for your product stream.
Patch Information
Red Hat tracks remediation under Red Hat Bug Report #2510883. Consult the Red Hat CVE-2026-76166 Advisory for fixed package versions for each affected product stream. Fixed builds add null validation in verifyDigest() and broaden the worker thread's exception handling so a malformed datagram does not terminate the listener.
Workarounds
- Disable the mod_cluster advertise mechanism and configure static proxy lists using the proxy-list or equivalent configuration option where deployment topology allows.
- Enforce firewall or ACL rules that permit UDP multicast on the advertise port only from known cluster peers.
- Deploy monitoring that restarts the affected JVM when advertise traffic stops, reducing the window of silent failure until patches are applied.
# Example: disable advertise on WildFly / JBoss EAP mod_cluster subsystem
/subsystem=modcluster/proxy=default:write-attribute(name=advertise,value=false)
/subsystem=modcluster/proxy=default:list-add(name=proxies,value=proxy1)
reload
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
