{"id":"CVE-2016-2141","aliases":["GHSA-rc7h-x6cq-988q"],"url":"https://o3.security/vulnerability/CVE-2016-2141","summary":"Improper Input Validation in JGroups","details":"It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information disclosure, message spoofing, or further possible attacks.","published":"2016-06-30T16:59:00.117Z","modified":"2026-03-15T22:21:55.851522Z","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"org.jgroups:jgroups","fixedVersion":"3.6.10.Final"},{"ecosystem":"Maven","name":"org.jgroups:jgroups","fixedVersion":"3.2.16.Final"}],"fix":{"url":"https://github.com/belaban/JGroups/commit/eeaf5241cce464ef21a2dfc4938729ade9ebef36","label":"belaban/JGroups@eeaf524"},"references":[{"type":"WEB","url":"https://lists.apache.org/thread.html/rb37cc937d4fc026fb56de4b4ec0d054aa4083c1a4edd0d8360c068a0%40%3Cdev.geode.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/ra18cac97416abc2958db0b107877c31da28d884fa6e70fd89c87384a%40%3Cdev.geode.apache.org%3E"},{"type":"ADVISORY","url":"https://rhn.redhat.com/errata/RHSA-2016-1329.html"},{"type":"ADVISORY","url":"https://rhn.redhat.com/errata/RHSA-2016-1331.html"},{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/91481"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2016:1376"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2016:1434"},{"type":"ADVISORY","url":"https://rhn.redhat.com/errata/RHSA-2016-1330.html"},{"type":"ADVISORY","url":"https://rhn.redhat.com/errata/RHSA-2016-1332.html"},{"type":"ADVISORY","url":"http://rhn.redhat.com/errata/RHSA-2016-1439.html"},{"type":"ADVISORY","url":"http://www.securitytracker.com/id/1036165"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2016:1345"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2016:1374"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2016:1389"},{"type":"ADVISORY","url":"https://rhn.redhat.com/errata/RHSA-2016-1334.html"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2016:1346"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2016:1433"},{"type":"ADVISORY","url":"https://rhn.redhat.com/errata/RHSA-2016-1328.html"},{"type":"ADVISORY","url":"https://rhn.redhat.com/errata/RHSA-2016-1333.html"},{"type":"ADVISORY","url":"http://rhn.redhat.com/errata/RHSA-2016-1435.html"},{"type":"ADVISORY","url":"http://rhn.redhat.com/errata/RHSA-2016-2035.html"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2016:1347"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2016:1432"},{"type":"REPORT","url":"https://issues.jboss.org/browse/JGRP-2021"},{"type":"FIX","url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-2141"},{"type":"WEB","url":"https://github.com/belaban/JGroups/commit/eeaf5241cce464ef21a2dfc4938729ade9ebef36"},{"type":"WEB","url":"https://web.archive.org/web/20201207092245/http://www.securitytracker.com/id/1036165"},{"type":"WEB","url":"https://web.archive.org/web/20161013163606/http://www.securityfocus.com/bid/91481"},{"type":"WEB","url":"https://lists.apache.org/thread.html/rb37cc937d4fc026fb56de4b4ec0d054aa4083c1a4edd0d8360c068a0@%3Cdev.geode.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/ra18cac97416abc2958db0b107877c31da28d884fa6e70fd89c87384a@%3Cdev.geode.apache.org%3E"},{"type":"WEB","url":"https://issues.redhat.com/browse/JGRP-2074"},{"type":"WEB","url":"https://issues.redhat.com/browse/JGRP-2055"},{"type":"PACKAGE","url":"https://github.com/belaban/JGroups"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-03-15T22:21:55.851522Z"}}