CVE-2026-107938: Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification.

As cited

Copy frozen at 2026-10-09 13:24 UTC (site build).

vulnerabilities

CVE-2026-107938: Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification.

Apache CXF's Netty-based HTTP client transport failed to verify that TLS certificates matched the hostname being accessed, affecting versions 3.x before 3.6.13, 4.0.x before 4.1.9, and 4.2.x before 4.2.4. The vulnerability applied to both HTTP/1.1 and HTTP/2 connections even when hostname verification was left enabled by default. Organizations using the affected versions should patch immediately to prevent man-in-the-middle attacks.

Why it matters: Teams deploying Apache CXF with the Netty HTTP client transport are exposed to certificate validation bypass attacks; patch to 3.6.13, 4.1.9, or 4.2.4 or later immediately.

Source published

2026-10-09 10:29 UTC

First seen by Cybersecurity Tracker

2026-10-09 11:33 UTC