CyberRota Analysis
AI-GeneratedA vulnerability exists in the AdvertiseListenerImpl component of mod_cluster, where a specially crafted UDP multicast datagram can trigger a NullPointerException, leading to a permanent termination of the advertise listener thread. This failure occurs silently, allowing the system to appear operational while it is actually non-functional, and persists until the node is restarted. Organizations utilizing mod_cluster should prioritize remediation to prevent potential disruptions in service and ensure the reliability of their deployments.
Original NVD Description
A flaw was found in mod_cluster's AdvertiseListenerImpl (org.jboss.modcluster core module). A single crafted UDP multicast datagram with a valid HTTP status line and a "Server:" header but without the "Date:", "Digest:", and "Sequence:" headers triggers a NullPointerException in verifyDigest() that is not caught by the worker thread's exception handler. This causes the advertise listener thread to terminate permanently. The failure is silent (isListening() continues to return true) and persists until the node is restarted. The crash occurs before the AdvertiseSecurityKey comparison, so deployments with a configured security key are still affected.