CLEANSTART-2026-IJ02845: In Apache CXF, the Netty-based HTTP client transport (cxf-rt-transports-http-netty-client) did not verify that the hostname in the server’s TLS certificate matched the host being called
Security vulnerability affects the wso2am package. In Apache CXF, the Netty-based HTTP client transport (cxf-rt-transports-http-netty-client) did not verify that the hostname in the server’s TLS certificate matched the host being called.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/wso2amto a version that resolves this vulnerability.Fixed in 4.7.0-r4
Event History
Frequently Asked Questions
Which installations are in scope?
The advisory identifies the cleanstart/wso2am package as affected. Exposure is specifically tied to use of Apache CXF's Netty-based HTTP client transport, cxf-rt-transports-http-netty-client.
Does exploitation require authentication or user interaction?
No. The supplied CVSS vector lists network attack access, low attack complexity, no privileges required, and no user interaction.
What security properties are affected?
The supplied CVSS vector rates confidentiality and integrity impact as high, with no availability impact.