CVE-2016-8612

17

FAUCET Score

CVE-2016-8612 describes an Improper Input Validation vulnerability in the mod_cluster module of Apache HTTP Server versions prior to 2.4.23, leading to a Segmentation Fault in the serving httpd process. This vulnerability primarily impacts Apache HTTP Server and related products from Red Hat and NetApp. With a CVSS score of 4.3 (MEDIUM), it can be exploited with low attack complexity over the network, resulting in a denial of service. There is no known active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		< 2.4.23CPE matchmatch criteria	cpe:2.3:a:apache:http_server::::::::
		6.0CPE matchmatch criteria	cpe:2.3:o:redhat:enterprise_linux:6.0:::::::*
		7.0CPE matchmatch criteria	cpe:2.3:o:redhat:enterprise_linux:7.0:::::::*
		Range not provided by sourceCPE matchmatch criteria	cpe:2.3:a:netapp:storage_automation_store:-:::::::*

CVSS Data

CVSS version used by this source: 3.0

4.3MEDIUM

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

Exploitability Score

2.8

Impact Score

1.4

CvssVersion

3.0

Exploit Intelligence

EPSS Score

4.53%

Probability of exploitation in next 30 days

EPSS Percentile

90.5%

Percentile rank of EPSS score among Peer Group

As of 2026-07-24

Model: v2026.06.15

This CVE's current EPSS score of 0.0453 is in the 98th percentile among its peer group of 1,801 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (23)

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 6Fixed in: jbcs-httpd24-httpd-0:2.4.23-102.jbcs.el6

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 6Fixed in: jbcs-httpd24-mod_auth_kerb-0:5.4-35.jbcs.el6

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 6Fixed in: jbcs-httpd24-mod_bmx-0:0.9.6-14.GA.jbcs.el6

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 6Fixed in: jbcs-httpd24-mod_cluster-native-0:1.3.5-13.Final_redhat_1.jbcs.el6

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 6Fixed in: jbcs-httpd24-mod_jk-0:1.2.41-14.redhat_1.jbcs.el6

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 6Fixed in: jbcs-httpd24-mod_rt-0:2.4.1-16.GA.jbcs.el6

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 6Fixed in: jbcs-httpd24-mod_security-0:2.9.1-18.GA.jbcs.el6

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 6Fixed in: jbcs-httpd24-nghttp2-0:1.12.0-9.jbcs.el6

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 6Fixed in: jbcs-httpd24-openssl-1:1.0.2h-12.jbcs.el6

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-httpd-0:2.4.23-102.jbcs.el7

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-mod_auth_kerb-0:5.4-35.jbcs.el7

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-mod_bmx-0:0.9.6-14.GA.jbcs.el7

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-mod_cluster-native-0:1.3.5-13.Final_redhat_1.jbcs.el7

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-mod_jk-0:1.2.41-14.redhat_1.jbcs.el7

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-mod_rt-0:2.4.1-16.GA.jbcs.el7

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-mod_security-0:2.9.1-18.GA.jbcs.el7

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-nghttp2-0:1.12.0-9.jbcs.el7

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-openssl-1:1.0.2h-12.jbcs.el7

redhatpatch availablevia redhat_api

Product: Text-Only JBCS

redhatno patchvia redhat_api

Product: Red Hat JBoss Enterprise Web Server 3Fixed in: mod_cluster

redhatend of lifevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 5Fixed in: mod_cluster

redhatend of lifevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 6Fixed in: mod_cluster

redhatend of lifevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 2Fixed in: mod_cluster

Vendor Advisories (1)

redhatCVE-2016-8612Low

mod_cluster: Protocol parsing logic error

References

rhn.redhat.com / errata/RHSA-2016-2957.html

Third Party Advisory

access.redhat.com / errata/RHSA-2017:0193

Third Party Advisory

access.redhat.com / errata/RHSA-2017:0194

Third Party Advisory

bugzilla.redhat.com / show_bug.cgi

Issue TrackingThird Party Advisory

security.netapp.com / advisory/ntap-20180601-0005

Third Party Advisory

securityfocus.com / bid/94939

Third Party AdvisoryVDB Entry