Skip to content
VulniPulse
Sign in
Advisory severityUnratedApache Software Foundation Updated

Advisory [CVE-2026-107938] In Apache CXF, the Netty-based HTTP client transport (cxf-rt-transports-http-netty-client) did not verify that the hostname in the server’s TLS certificate matched the host being called

This security Apache Software Foundation advisory covers CVE-2026-107938; related products: Apache CXF.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2026-107938 Source published Source updated

VulniPulse record published Record updated

CVE-2026-107938
Related products & platforms
Apache Software FoundationUnclassified
Open source advisory

Android app · Google Play

Monitor future Apache Software Foundation CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features

Summary

In Apache CXF, the Netty-based HTTP client transport (cxf-rt-transports-http-netty-client) did not verify that the hostname in the server’s TLS certificate matched the host being called. This applied over both HTTP/1.1 and HTTP/2, even when disableCNCheck was left at its default value of false.

The certificate chain was validated against the configured trust store, but the endpoint’s identity was not. A network attacker able to intercept traffic could present any certificate trusted by the client, such as a publicly issued certificate for a domain they control, and impersonate the target service.

They could then read or modify the exchanged messages, including credentials. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.

Affected versions
  • Apache CXF 4.2.0 before 4.2.4
  • Apache CXF 4.0.0 before 4.1.9
  • Apache CXF before 3.6.13

Official advisory · medium-confidence parse· fetched 16 hours ago·verify at source

Fixed versions
  • 4.2.4
  • 4.1.9
  • 3.6.13

Official advisory · medium-confidence parse· fetched 16 hours ago·verify at source

Mitigation checklist

Recommended fix / mitigation
  • Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.

Official advisory · medium-confidence parse· fetched 16 hours ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.