https://seclists.org/oss-sec/2026/q4/115: CVE-2026-107938: Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification.
Affected Software
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Apache CXF's Netty-based HTTP client transport, cxf-rt-transports-http-netty-client, are affected in the listed vulnerable versions. The issue applies to both HTTP/1.1 and HTTP/2 connections.
Does the default hostname-checking configuration prevent exploitation?
No. Hostname verification was not performed even when disableCNCheck was left at its default value of false.
What does an attacker need to exploit this vulnerability?
An attacker must be able to intercept the client's network traffic. They also need a certificate trusted by the client's configured trust store, but it can be a certificate for a different hostname, such as a publicly issued certificate for a domain the attacker controls.
What is the impact of a successful attack?
The attacker can impersonate the intended target service and read or modify exchanged messages. This can include credentials sent through the client connection.
What versions contain the fix?
Upgrade to Apache CXF 4.2.4, 4.1.9, or 3.6.13, as applicable to the release line in use.