CVE-2026-107938: Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification.
Apache CXF Netty HTTP client skipped TLS hostname verification, enabling potential man-in-the-middle attacks.
Apache CXF's Netty-based HTTP client transport did not verify that a server TLS certificate hostname matched the host being called. CVE-2026-107938 applies over HTTP/1.1 and HTTP/2 even when disableCNCheck is left at its default of false. Apache rates the flaw important. Affected ranges are CXF before 3.6.13, 4.0.0 before 4.1.9, and 4.2.0 before 4.2.4; no exploitation is reported.
- Netty HTTP client did not check TLS certificate hostnames.
- Flaw applies to HTTP/1.1 and HTTP/2 when disableCNCheck is false.
- Affects CXF before 3.6.13, 4.0.0 before 4.1.9, and 4.2.0 before 4.2.4.
- Apache rates the issue important; exploitation is not mentioned.
- CVEs
- CVE-2026-107938
- Vendors
- Apache
- Products
- Apache CXF
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-107938 | Missing TLS hostname check in Apache CXF Netty HTTP client | 9.1 | — |
From the original article
Posted by Colm O hEigeartaigh on Oct 09 Severity: important Affected versions: - Apache CXF 4. 2. 0 before 4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.