Read the docs
TI-2016-03833 Aliases CVE-2016-4459GHSA-wcxv-fwxr-qwf7

Stack-based buffer overflow in native/mod_manager/node.c in mod_cluster 1.2.9.

Priority LOW 38CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 6 fixed, 2 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-119 and the CVSS impact.

Summary

Stack-based buffer overflow in native/mod_manager/node.c in mod_cluster 1.2.9.

Why it matters now

EPSS 0.02669 85th percentileScored 2026-11-07
Fix Partial Red Hat: 6 advisoriesRed Hat: 6 fixed, 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:redhat:mod_cluster:1.2.9:*:*:*:*:*:*:*1.2.9VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
  • cpe:2.3:a:redhat:mod_cluster:1.2.9:*:*:*:*:*:*:* Versions 1.2.9 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat

Remediation

Red Hat 6 advisories

  • RHSA-2017:0193 Released 2017-01-25 · Red Hat rating Important
    Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Release on RHEL 6
    • Red Hat JBoss Core Services on RHEL 6 Server jbcs-httpd24-httpd-2.4.23-102.jbcs.el6, jbcs-httpd24-httpd-devel-2.4.23-102.jbcs.el6, jbcs-httpd24-httpd-manual-2.4.23-102.jbcs.el6 +27
  • RHSA-2017:0194 Released 2017-01-25 · Red Hat rating Important
    Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Release on RHEL 7
    • Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-httpd-2.4.23-102.jbcs.el7, jbcs-httpd24-httpd-devel-2.4.23-102.jbcs.el7, jbcs-httpd24-httpd-manual-2.4.23-102.jbcs.el7 +25
  • RHSA-2016:2957 Released 2016-12-15 · Red Hat rating Important
    Red Hat JBoss Core Services Apache HTTP 2.4.23 Release
    • Red Hat JBoss Core Services
Show 3 more Red Hat advisories
  • RHSA-2016:2055 Released 2016-10-12 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 6.4.10 natives update on RHEL 6
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server hornetq-native-2.3.25-4.SP11_redhat_1.ep6.el6, hornetq-native-2.3.25-4.SP11_redhat_1.ep6.el6.i386, httpd-2.2.26-54.ep6.el6 +29
  • RHSA-2016:2054 Released 2016-10-12 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 6.4.10 natives update on RHEL 7
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server hornetq-native-2.3.25-4.SP11_redhat_1.ep6.el7, httpd22-2.2.26-56.ep6.el7, httpd22-devel-2.2.26-56.ep6.el7 +17
  • RHSA-2016:2056 Released 2016-10-12 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4.10 update
    • Red Hat JBoss Enterprise Application Platform 6.4

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Enterprise Web Server 2AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Web Server 3AffectedNo fix yet
Red Hat JBoss Core ServicesFixed RHSA-2016:2957
Red Hat JBoss Core Services on RHEL 6 ServerFixed RHSA-2017:0193
Red Hat JBoss Core Services on RHEL 7 ServerFixed RHSA-2017:0194
Red Hat JBoss Enterprise Application Platform 6.4Fixed RHSA-2016:2056
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 ServerFixed RHSA-2016:2055
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 ServerFixed RHSA-2016:2054

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-4459
  2. 2026-10-03 Alias added: GHSA-wcxv-fwxr-qwf7

References

Advisory 6

Other 1

  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-10530 Code injection in [UNKNOWN] RichFaces KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-23530 Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf… KEVCVSS 3.1CRITICAL 9.3
  • TI-2021-17490 mod_proxy SSRF KEVCVSS 3.1CRITICAL 9.0
See all 1955 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences