Improper input validation in Red Hat mod_cluster
Priority LOW 27CWE-20Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Partial Red Hat: 3 fixed, 4 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat.
Summary
Apache HTTP Server mod_cluster before version httpd 2.4.23 is vulnerable to an Improper Input Validation in the protocol parsing logic in the load balancer resulting in a Segmentation Fault in the serving httpd process.
Why it matters now
EPSS 0.04442 91st percentileScored 2026-11-07
Fix Partial Red Hat: 3 advisoriesRed Hat: 3 fixed, 4 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | mod_cluster | httpd 2.4.23 | — | No fix listed | CNA |
- mod_cluster VendorRed Hat Affected httpd 2.4.23 Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* | before 2.4.23 | Vulnerable | Apache |
| cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:a:netapp:storage_automation_store:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* Versions before 2.4.23 Vulnerable ·Apache
- cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:a:netapp:storage_automation_store:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Remediation
Red Hat 3 advisories
- RHSA-2017:0193 Released 2017-01-25 · Red Hat rating ImportantRed Hat JBoss Core Services Apache HTTP Server 2.4.23 Release on RHEL 6
- Red Hat JBoss Core Services on RHEL 6 Server jbcs-httpd24-httpd-2.4.23-102.jbcs.el6, jbcs-httpd24-httpd-devel-2.4.23-102.jbcs.el6, jbcs-httpd24-httpd-manual-2.4.23-102.jbcs.el6 +27
- RHSA-2017:0194 Released 2017-01-25 · Red Hat rating ImportantRed Hat JBoss Core Services Apache HTTP Server 2.4.23 Release on RHEL 7
- Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-httpd-2.4.23-102.jbcs.el7, jbcs-httpd24-httpd-devel-2.4.23-102.jbcs.el7, jbcs-httpd24-httpd-manual-2.4.23-102.jbcs.el7 +25
- RHSA-2016:2957 Released 2016-12-15 · Red Hat rating ImportantRed Hat JBoss Core Services Apache HTTP 2.4.23 Release
- Red Hat JBoss Core Services
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss Enterprise Application Platform 5 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Enterprise Application Platform 6 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Enterprise Web Server 2 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Enterprise Web Server 3 | Affected | No fix yet |
| Red Hat JBoss Core Services | Fixed | RHSA-2016:2957 |
| Red Hat JBoss Core Services on RHEL 6 Server | Fixed | RHSA-2017:0193 |
| Red Hat JBoss Core Services on RHEL 7 Server | Fixed | RHSA-2017:0194 |
Not affected: 1 product
- Red Hat JBoss Enterprise Application Platform 7
Timeline
- 2026-10-02 Threatist record created from CVE-2016-8612
- 2026-10-03 Alias added: GHSA-pw68-p55m-86x8
References
More Red Hat Enterprise Linux vulnerabilities
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2018-10530 Code injection in [UNKNOWN] RichFaces KEVCVSS 3.1CRITICAL 9.8
- TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
- TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
- TI-2025-23530 Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf… KEVCVSS 3.1CRITICAL 9.3
- TI-2021-17490 mod_proxy SSRF KEVCVSS 3.1CRITICAL 9.0
Sources
- CVE-2016-8612 · CVE Program
- CVE-2016-8612 · NVD
- FIRST EPSS
- GHSA-pw68-p55m-86x8 · GitHub Advisory Database · CC BY 4.0
- CVE-2016-8612 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences