Description
It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information disclosure, message spoofing, or further possible attacks.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libjgroups-java | No fix yet | — |
| Debian 13 | libjgroups-java | No fix yet | — |
| Debian 12 | libjgroups-java | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | libjgroups-java | No fix yet | — |
| Ubuntu 26.04 LTS | libjgroups-java | No fix yet | — |
| Ubuntu 25.10 | libjgroups-java | No fix yet | — |
| Ubuntu 24.04 LTS | libjgroups-java | No fix yet | — |
| Ubuntu 22.04 LTS | libjgroups-java | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | libjgroups-java | No fix yet | — |
| Ubuntu 18.04 LTS | libjgroups-java | No fix yet | — |
| Ubuntu 16.04 LTS | libjgroups-java | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 7 | eap7-jgroups | 3.6.8-3.Final_redhat_3.1.ep7.el6 | RHSA-2016:1332 |
| Red Hat JBoss EAP 6 | apache-cxf | 2.7.18-2.SP1_redhat_1.1.ep6.el6 | RHSA-2016:1434, RHSA-2016:1433 |
| Red Hat JBoss EAP 6 | glassfish-jsf-eap6 | 2.1.28-11.SP10_redhat_1.1.ep6.el6 | RHSA-2016:1434, RHSA-2016:1433 |
| Red Hat JBoss EAP 6 | hibernate4-validator | 4.3.3-1.Final_redhat_1.1.ep6.el6 | RHSA-2016:1434, RHSA-2016:1433 |
| Red Hat JBoss EAP 6 | hornetq | 2.3.25-13.SP11_redhat_1.1.ep6.el6 | RHSA-2016:1434, RHSA-2016:1433 |
| Red Hat JBoss EAP 6 | jboss-as-ee +62 | 7.5.9-2.Final_redhat_2.1.ep6.el6 | RHSA-2016:1434, RHSA-2016:1433 |
| Red Hat JBoss EAP 6 | jboss-ec2-eap +1 | 7.5.9-2.Final_redhat_2.ep6.el6 | RHSA-2016:1432 |
| Red Hat JBoss EAP 6 | jboss-jsf-api_2.1_spec | 2.1.28-6.SP2_redhat_1.1.ep6.el6 | RHSA-2016:1434, RHSA-2016:1433 |
| Red Hat JBoss EAP 6 | jboss-msc | 1.1.6-1.Final_redhat_1.1.ep6.el6 | RHSA-2016:1434, RHSA-2016:1433 |
| Red Hat JBoss EAP 6 | jbossts | 1:4.17.34-1.Final_redhat_1.1.ep6.el6 | RHSA-2016:1434, RHSA-2016:1433 |
| Red Hat JBoss EAP 6 | jbossweb | 7.5.17-1.Final_redhat_1.1.ep6.el6 | RHSA-2016:1434, RHSA-2016:1433 |
| Red Hat JBoss EAP 6 | jgroups | 1:3.2.16-1.Final_redhat_1.1.ep6.el5 | RHSA-2016:1330 |
| Red Hat JBoss EAP 6 | picketlink-bindings +1 | 2.5.4-11.SP9_redhat_2.1.ep6.el6 | RHSA-2016:1434, RHSA-2016:1433 |
| Red Hat JBoss EAP 6 | xalan-j2-eap6 | 2.7.1-11.redhat_11.1.ep6.el6 | RHSA-2016:1434, RHSA-2016:1433 |
| Red Hat JBoss EAP 5 | jgroups | 1:2.6.22-2.ep5.el4 | RHSA-2016:1328 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jgroups:jgroups | >= 3.3.0.Alpha1, < 3.6.10.Final | 3.6.10.Final | GHSA-rc7h-x6cq-988q |
| Maven | org.jgroups:jgroups | < 3.2.16.Final | 3.2.16.Final | GHSA-rc7h-x6cq-988q |
Advisories 8
- RHSA-2016:1434 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2016:1432 Red Hat Security Advisory: jboss-ec2-eap security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2016:1433 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.9 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2016:1332 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.0 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2016:1328 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 5.2 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2016:1330 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- WID-SEC-2026-0180 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2024-3616 Red Hat JBoss Fuse: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 5, 2024
References
- RHSA-2016:1347 vendor-advisory
- RHSA-2016:2035 vendor-advisory
- RHSA-2016:1389 vendor-advisory
- RHSA-2016:1345 vendor-advisory
- RHSA-2016:1376 vendor-advisory
- RHSA-2016:1330 vendor-advisory
- RHSA-2016:1439 vendor-advisory
- RHSA-2016:1331 vendor-advisory
- 91481 vdb-entry
- RHSA-2016:1434 vendor-advisory
- RHSA-2016:1328 vendor-advisory
- RHSA-2016:1433 vendor-advisory
- https://issues.jboss.org/browse/JGRP-2021
- RHSA-2016:1374 vendor-advisory
- RHSA-2016:1432 vendor-advisory
- RHSA-2016:1346 vendor-advisory
- RHSA-2016:1334 vendor-advisory
- RHSA-2016:1333 vendor-advisory
- RHSA-2016:1329 vendor-advisory
- RHSA-2016:1332 vendor-advisory
- RHSA-2016:1435 vendor-advisory
- 1036165 vdb-entry
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- [geode-dev] 20200407 JGroups vulnerabilty mailing-list
- [geode-dev] 20200407 Re: JGroups vulnerabilty mailing-list