CLEANSTART-2026-RA18069: In Apache CXF, the Netty-based HTTP client transport (cxf-rt-transports-http-netty-client) did not verify that the hostname in the server’s TLS certificate matched the host being called

Q: Which deployments should be prioritized for investigation?

Prioritize deployments of the cleanstart/wso2am package that include or use Apache CXF's Netty-based HTTP client transport, cxf-rt-transports-http-netty-client. The provided data does not identify affected package versions or configuration conditions.

Q: Does exploitation require credentials or user interaction?

No. The supplied vector indicates network exploitation with low attack complexity, no privileges required, and no user interaction required.

Q: What security impact is indicated?

The vulnerability is rated critical at 9.1 and indicates high confidentiality and integrity impact. The supplied vector indicates no availability impact.

Published Nov 11, 2026

Updated

Security vulnerability affects the wso2am package. In Apache CXF, the Netty-based HTTP client transport (cxf-rt-transports-http-netty-client) did not verify that the hostname in the server’s TLS certificate matched the host being called.

Affected Software

1 affected componentFixes available

cleanstart/wso2am<4.7.0-r5

4.7.0-r5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/wso2am to a version that resolves this vulnerability.
Fixed in 4.7.0-r5

Event History

Nov 11, 2026

Advisory Published

via OSV·12:37 AM

Data Sourced

via OSV·12:37 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-107938

Frequently Asked Questions

Which deployments should be prioritized for investigation?

Prioritize deployments of the cleanstart/wso2am package that include or use Apache CXF's Netty-based HTTP client transport, cxf-rt-transports-http-netty-client. The provided data does not identify affected package versions or configuration conditions.

Does exploitation require credentials or user interaction?

No. The supplied vector indicates network exploitation with low attack complexity, no privileges required, and no user interaction required.

What security impact is indicated?

The vulnerability is rated critical at 9.1 and indicates high confidentiality and integrity impact. The supplied vector indicates no availability impact.

CLEANSTART-2026-RA18069: In Apache CXF, the Netty-based HTTP client transport (cxf-rt-transports-http-netty-client) did not verify that the hostname in the server’s TLS certificate matched the host being called

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments should be prioritized for investigation?

Does exploitation require credentials or user interaction?

What security impact is indicated?

Company

Resources

Contact

Frequently Asked Questions

Which deployments should be prioritized for investigation?

Does exploitation require credentials or user interaction?

What security impact is indicated?