NULL pointer dereference in Red Hat Jboss Enterprise Application Platform 7
CVE-2026-76166
A flaw was found in mod_cluster's AdvertiseListenerImpl (org.jboss.modcluster core module). A single crafted UDP multicast datagram with a valid HTTP status line and a "Server:" header but without the "Date:", "Digest:", and "Sequence:" headers triggers a NullPointerException in verifyDigest() that is not caught by the worker thread's exception handler. This causes the advertise listener thread to terminate permanently. The failure is silent (isListening() continues to return true) and persists until the node is restarted. The crash occurs before the AdvertiseSecurityKey comparison, so deployments with a configured security key are still affected.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.
EPSS exploit prediction
EPSS: 0.010 (62.6th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 63rd percentile — 62.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.008 · newest: 0.010 · change: +0.002
Affected products
Weakness classification (CWE)
References
- access.redhat.com/security/cve/CVE-2026-76166 (vdb-entry)
- bugzilla.redhat.com/show_bug.cgi (issue-tracking)
Frequently asked questions
- What is CVE-2026-76166?
- CVE-2026-76166 is a medium-severity vulnerability in Red Hat Jboss Enterprise Application Platform 7, classified under NULL Pointer Dereference. CVSS score: 4.3/10. Published 2026-08-19.
- How severe is CVE-2026-76166?
- Medium severity. CVSS v3 base score is 4.3 out of 10.