REDHAT-BUG-2510883: Medium severity JBoss mod_cluster/modcluster vulnerability
Reported via PSIRTSUPT-20286 by Ta Duc Thien from Ninh Thanh Cyber Security (NTCS).
Vulnerability in org.jboss.modcluster core module, class AdvertiseListenerImpl. A crafted UDP multicast datagram (missing Date/Digest/Sequence headers) triggers an uncaught NullPointerException in verifyDigest() that kills the advertise worker thread permanently. Works even with AdvertiseSecurityKey configured (NPE fires before key comparison). Silent failure — isListening() keeps returning true.
Upstream: https://github.com/modcluster/modcluster Affected version: 2.1.0.Final (confirmed by reporter, same code on current main branch) Reporter's PoC and full write-up attached to PSIRTSUPT-20286.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using the org.jboss.modcluster core module's AdvertiseListenerImpl are exposed when they receive crafted UDP multicast advertisement traffic. The issue is confirmed in version 2.1.0.Final, and the same code is reported to be present on the current main branch.
Does configuring AdvertiseSecurityKey prevent exploitation?
No. A datagram that omits the Date, Digest, and Sequence headers triggers the NullPointerException before the configured key is compared.
What does successful exploitation do?
It permanently terminates the advertise worker thread. The failure is silent because isListening() continues to return true even after the worker thread has died.