Description

A flaw was found in mod_cluster's AdvertiseListenerImpl (org.jboss.modcluster core module). A single crafted UDP multicast datagram with a valid HTTP status line and a "Server:" header but without the "Date:", "Digest:", and "Sequence:" headers triggers a NullPointerException in verifyDigest() that is not caught by the worker thread's exception handler. This causes the advertise listener thread to terminate permanently. The failure is silent (isListening() continues to return true) and persists until the node is restarted. The crash occurs before the AdvertiseSecurityKey comparison, so deployments with a configured security key are still affected.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-19T10:16:38.150Z",
  "pubdate": "2026-08-19T10:16:38.150Z",
  "executiveSummary": "A denial of service vulnerability exists within the AdvertiseListenerImpl component of the org.jboss.modcluster core module. The flaw enables an unauthenticated remote attacker to cause a permanent silent crash of the advertise listener thread by transmitting a single maliciously crafted UDP multicast datagram.\nThe vulnerability is triggered due to improper exception handling when processing malformed HTTP responses within the digest verification routine. Specifically, an input containing a valid HTTP status line and a Server header, but omitting the Date, Digest, and Sequence headers, provokes an uncaught NullPointerException in the verifyDigest() function.\nThe impact of this vulnerability is a persistent denial of service affecting mod_cluster advertise functionality. Because the exception escapes the worker thread's exception handler, the advertise listener thread terminates permanently while the isListening() method incorrectly continues to report a healthy operational status. The service disruption persists until the affected node is manually restarted.\nCrucially, the crash execution path triggers prior to the AdvertiseSecurityKey validation check, meaning deployments configured with an active security key remain entirely vulnerable to exploitation. No special privileges or prior authentication are required, and the attack vector is exposed via the multicast network interface utilized by the advertise listener.",
  "technicalDetails": "The vulnerability resides in the AdvertiseListenerImpl component, specifically within the org.jboss.modcluster core module responsible for handling cluster advertisement communication over UDP multicast protocols.\nThe root cause of the flaw is the absence of robust input validation and defensive exception handling within the digest verification mechanism. When the listener receives a UDP multicast datagram, it parses the incoming payload assuming a specific structural format associated with cluster communication messages.\nThe step-by-step attack flow begins when an attacker transmits a specially crafted UDP multicast datagram to the network segment monitored by the mod_cluster advertise listener. This crafted payload contains a valid HTTP status line and a Server header, but intentionally omits mandatory headers including Date, Digest, and Sequence.\nUpon receiving this malformed datagram, the advertise listener passes the payload to the verifyDigest() function for validation. Because the expected headers are absent from the parsed message structure, the code attempts to access null object references during the digest calculation or comparison steps, resulting in a NullPointerException.\nThe vulnerability is exacerbated by the lack of proper exception handling within the worker thread execution context. The NullPointerException propagates uncaught, bypassing the thread's exception handler and causing the advertise listener thread to terminate abruptly and permanently.\nAn important architectural detail of this failure mode is its silent nature. Following the thread termination, the internal isListening() method continues to return true, masking the outage from administrative monitoring tools and automated health checks. The listener remains non-functional, and cluster topology updates via advertise mechanisms fail indefinitely until the affected node undergoes a complete restart.\nFurthermore, the code path leading to the NullPointerException executes before the evaluation of the AdvertiseSecurityKey. Consequently, cryptographic hardening via a configured security key does not mitigate or prevent the crash, leaving secured deployments equally susceptible.\nThe attack vector requires network access to the UDP multicast group utilized by mod_cluster. No authentication or prior system privileges are required to transmit the malicious multicast datagram."
}