Apache CXF patches TLS hostname and XML limit flaws

Apache CXF fixes an important TLS hostname-verification gap and a low-severity unbounded XML parsing issue in the same release lines.

Apache disclosed two Apache CXF flaws on 9 October 2026. CVE-2026-107938 is an important issue in the Netty-based HTTP client transport: it did not check that a server TLS certificate hostname matched the host being called, including over HTTP/1.1 and HTTP/2 when disableCNCheck remains at its default of false, which could allow man-in-the-middle attacks. No exploitation is reported for that flaw. Separately, CVE-2026-108039 is a low-severity issue in which StaxUtils imposed no default limit on the number of XML elements or characters, so an oversized document can exhaust memory and CPU during parsing, particularly when CXF builds a DOM for SAAJ or WS-Security. Both affect CXF before 3.6.13, 4.0.0 before 4.1.9, and 4.2.0 before 4.2.4; the XML fix adds default element and character limits in 3.6.13, 4.1.9, and 4.2.4. The two reports do not disagree on versions or severity.