A flaw in mod_cluster's AdvertiseListenerImpl (org.jboss.modcluster core module) allows a crafted UDP multicast datagram with a valid HTTP status line and a "Server:" header but missing "Date:", "Digest:", and "Sequence:" headers to trigger a NullPointerException in verifyDigest(). This exception is uncaught by the worker thread's handler, causing the advertise listener thread to terminate permanently. The failure is silent as isListening() continues to return true, and the condition persists until the node is restarted. The crash happens before AdvertiseSecurityKey comparison, so deployments with configured security keys remain vulnerable. The vulnerability results in a denial-of-service condition by crashing the advertise listener thread.

The vulnerability causes a denial-of-service (DoS) condition by crashing the advertise listener thread in mod_cluster, which remains non-functional until the affected node is restarted. There is no impact on confidentiality or integrity. The failure is silent, meaning monitoring may not detect the thread termination as isListening() returns true despite the thread being stopped. Security keys do not mitigate the issue as the crash occurs before their comparison.

Red Hat recommends disabling multicast-based proxy advertisement and using static proxy configuration instead. If multicast advertisement must be enabled, ensure the multicast network segment (default 224.0.1.105:23364) is properly isolated and inaccessible from untrusted networks. No official patch or fix status is provided in the advisory; therefore, patch status is not yet confirmed — check the vendor advisory for current remediation guidance.