CVE-2026-107938: Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification.
In Apache CXF, the Netty-based HTTP client transport (cxf-rt-transports-http-netty-client) did not verify that the hostname in the server’s TLS certificate matched the host being called. This applied over both HTTP/1.1 and HTTP/2, even when disableCNCheck was left at its default value of false. The certificate chain was validated against the configured trust store, but the endpoint’s identity was not. A network attacker able to intercept traffic could present any certificate trusted by the client, such as a publicly issued certificate for a domain they control, and impersonate the target service. They could then read or modify the exchanged messages, including credentials. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache CXF Netty HTTP client transport (cxf-rt-transports-http-netty-client)to a version that resolves this vulnerability.Fixed in 4.2.4 - Upgrade
Upgrade
Apache CXF Netty HTTP client transport (cxf-rt-transports-http-netty-client)to a version that resolves this vulnerability.Fixed in 4.1.9 - Upgrade
Upgrade
Apache CXF Netty HTTP client transport (cxf-rt-transports-http-netty-client)to a version that resolves this vulnerability.Fixed in 3.6.13
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Apache CXF's Netty-based HTTP client transport, cxf-rt-transports-http-netty-client, are affected when they make TLS connections. The issue applies to both HTTP/1.1 and HTTP/2.
Does leaving disableCNCheck set to false protect against this problem?
No. Hostname verification was not performed even when disableCNCheck retained its default value of false.
What does an attacker need to exploit it?
An attacker must be able to intercept the client's network traffic and present a certificate trusted by the client's configured trust store. The certificate need not match the hostname of the intended service.
What is the impact if exploitation succeeds?
The attacker can impersonate the target service, read exchanged messages, and modify them. This can expose credentials carried in those messages.
Which versions contain the fix?
Upgrade to Apache CXF version 4.2.4, 4.1.9, or 3.6.13.