CVE-2026-76166 is a flaw in mod_cluster's AdvertiseListenerImpl where a specially crafted UDP multicast datagram containing a valid HTTP status line and a "Server:" header but lacking the "Date:", "Digest:", and "Sequence:" headers triggers an uncaught NullPointerException in the verifyDigest() method. This exception causes the advertise listener thread to terminate permanently without proper error handling, while the isListening() method continues to report the listener as active. The crash occurs before any AdvertiseSecurityKey comparison, so security key configurations do not prevent the issue. The failure results in a denial-of-service condition until the affected node is restarted.

The vulnerability causes a denial-of-service (DoS) by crashing the advertise listener thread in mod_cluster, which remains silently non-functional while appearing active. This disrupts the proxy advertisement mechanism until the node is restarted. There is no impact on confidentiality or integrity, and no known code execution or information disclosure. The issue affects availability with a low impact severity.

No official patch or fix is currently available. The vendor advisory recommends disabling multicast-based proxy advertisement and using static proxy configuration as a mitigation. If multicast advertisement must be enabled, ensure the multicast network segment (default 224.0.1.105:23364) is properly isolated and inaccessible from untrusted networks to reduce exposure.