Reported via PSIRTSUPT-20286 by Ta Duc Thien from Ninh Thanh Cyber Security (NTCS).

Vulnerability in org.jboss.modcluster core module, class AdvertiseListenerImpl. A crafted UDP multicast datagram (missing Date/Digest/Sequence headers) triggers an uncaught NullPointerException in verifyDigest() that kills the advertise worker thread permanently. Works even with AdvertiseSecurityKey configured (NPE fires before key comparison). Silent failure — isListening() keeps returning true.

Upstream: https://github.com/modcluster/modcluster Affected version: 2.1.0.Final (confirmed by reporter, same code on current main branch) Reporter's PoC and full write-up attached to PSIRTSUPT-20286.