Read the docs
TI-2016-02608 Aliases CVE-2016-3110GHSA-68qq-3phh-53j7

mod_cluster, as used in Red Hat JBoss Web Server 2.1, allows remote attackers to cause a…

Priority LOW 39CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 6 fixed, 1 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

mod_cluster, as used in Red Hat JBoss Web Server 2.1, allows remote attackers to cause a denial of service (Apache http server crash) via an MCMP message containing a series of = (equals) characters after a legitimate element.

Why it matters now

EPSS 0.0364 89th percentileScored 2026-11-07
Fix Partial org.jboss.mod_cluster:mod_cluster-parent (Maven): 1.3.3.FinalRed Hat: 6 advisoriesRed Hat: 6 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.jboss.mod_cluster:mod_cluster-parent (Maven)before 1.3.3.Final1.3.3.FinalPatch availableGHSA-68qq-3phh-53j7
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.jboss.mod_cluster:mod_cluster-parent (Maven) Vendor— Affected before 1.3.3.Final Fixed in 1.3.3.Final Patch available GHSA-68qq-3phh-53j7

CPE configurations NVD · 9

CPEVersionsRoleVendor
cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:*6.0.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.4.0:*:*:*:*:*:*:*6.4.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_web_server:2.0.0:*:*:*:*:*:*:*2.0.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_web_server:2.1:*:*:*:*:*:*:*2.1VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*6.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0Running onRed Hat
cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:*28VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*29VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*30VulnerableFedoraproject
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:* Versions 6.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.4.0:*:*:*:*:*:*:* Versions 6.4.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_web_server:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_web_server:2.1:*:*:*:*:*:*:* Versions 2.1 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Red Hat
  • cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:* Versions 28 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:* Versions 29 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* Versions 30 Vulnerable ·Fedoraproject

Remediation

  • Fix · GHSA-68qq-3phh-53j7 org.jboss.mod_cluster:mod_cluster-parent (Maven) Fixed in 1.3.3.Final Advisory →

Red Hat 6 advisories

  • RHSA-2016:2055 Released 2016-10-12 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 6.4.10 natives update on RHEL 6
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server hornetq-native-2.3.25-4.SP11_redhat_1.ep6.el6, hornetq-native-2.3.25-4.SP11_redhat_1.ep6.el6.i386, httpd-2.2.26-54.ep6.el6 +29
  • RHSA-2016:2054 Released 2016-10-12 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 6.4.10 natives update on RHEL 7
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server hornetq-native-2.3.25-4.SP11_redhat_1.ep6.el7, httpd22-2.2.26-56.ep6.el7, httpd22-devel-2.2.26-56.ep6.el7 +17
  • RHSA-2016:2056 Released 2016-10-12 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4.10 update
    • Red Hat JBoss Enterprise Application Platform 6.4
Show 3 more Red Hat advisories
  • RHSA-2016:1648 Released 2016-08-22 · Red Hat rating Important
    Red Hat JBoss Web Server 2.1.1 security update on RHEL 7
    • Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server httpd22-2.2.26-56.ep6.el7, httpd22-devel-2.2.26-56.ep6.el7, httpd22-manual-2.2.26-56.ep6.el7 +17
  • RHSA-2016:1649 Released 2016-08-22 · Red Hat rating Important
    Red Hat JBoss Web Server 2.1.1 security update on RHEL 6
    • Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server httpd-2.2.26-54.ep6.el6, httpd-2.2.26-54.ep6.el6.i386, httpd-devel-2.2.26-54.ep6.el6 +26
  • RHSA-2016:1650 Released 2016-08-22 · Red Hat rating Important
    Red Hat JBoss Web Server 2.1.1 security update
    • Red Hat JBoss Web Server 2.1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Enterprise Web Server 3AffectedNo fix yet
Red Hat JBoss Enterprise Application Platform 6.4Fixed RHSA-2016:2056
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 ServerFixed RHSA-2016:2055
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 ServerFixed RHSA-2016:2054
Red Hat JBoss Enterprise Web Server 2 for RHEL 6 ServerFixed RHSA-2016:1649
Red Hat JBoss Enterprise Web Server 2 for RHEL 7 ServerFixed RHSA-2016:1648
Red Hat JBoss Web Server 2.1Fixed RHSA-2016:1650

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-3110
  2. 2026-10-03 Alias added: GHSA-68qq-3phh-53j7

References

Advisory 10

Other 9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences