Apache CXF: Missing TLS hostname verification in Netty HTTP client transport
Summary
The Netty-based HTTP client transport (cxf-rt-transports-http-netty-client) in Apache CXF does not check that the hostname in a server's TLS certificate matches the host being called, over both HTTP/1.1 and HTTP/2. Even with disableCNCheck at its default value of false, the certificate chain is validated but the server's identity is not. An attacker on the network path who can intercept traffic can present any certificate the client trusts, such as a public certificate for a domain they control, impersonate the target service, and read or modify exchanged messages, including credentials.
Affected
- Apache CXF 4.2.0 before 4.2.4
- Apache CXF 4.0.0 before 4.1.9
- Apache CXF before 3.6.13
- Only applications that use the Netty-based HTTP client transport are affected.
Fixed in
- Apache CXF 4.2.4
- Apache CXF 4.1.9
- Apache CXF 3.6.13
- Older branches (3.5.x and earlier) are not community-supported, and no verified fixed version for them is known.
Workaround
- Unknown. No vendor-documented workaround exists.
- Setting disableCNCheck does not protect against this issue.
- Until patched, avoid untrusted networks for affected Java applications.
Exploitation
- No exploitation in the wild is known.
- No public proof of concept is known.
- CISA SSVC assessment: Exploitation none, Automatable yes, Technical Impact total.
- The CISA KEV catalog should be re-checked, as it could not be queried directly.
Our recommendation
- Find all applications that include CXF on the classpath, for example with mvn dependency:tree or an SBOM.
- Upgrade to 4.2.4, 4.1.9 or 3.6.13 depending on the branch.
- Rebuild and redeploy the applications, because updating the host alone may leave the vulnerable copy in place.
- Verify the running version.
- Avoid untrusted networks for affected applications until the update is deployed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache CXF security advisory thread (Pony Mail) lists.apache.org
- oss-security post CVE-2026-107938 www.openwall.com
- Apache CXF security advisories cxf.apache.org
- Apache CXF advisory text (mail archive) www.mail-archive.com
- Apache CXF commit: Netty client TLS hostname verification mail-archive.com
- Apache CXF Security Advisories (wiki) cwiki.apache.org
- HeroDevs vulnerability directory: CVE-2026-107938 www.herodevs.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:07.
Original description (NVD)
In Apache CXF, the Netty-based HTTP client transport (cxf-rt-transports-http-netty-client) did not verify that the hostname in the server’s TLS certificate matched the host being called. This applied over both HTTP/1.1 and HTTP/2, even when disableCNCheck was left at its default value of false. The certificate chain was validated against the configured trust store, but the endpoint’s identity was not. A network attacker able to intercept traffic could present any certificate trusted by the client, such as a publicly issued certificate for a domain they control, and impersonate the target service. They could then read or modify the exchanged messages, including credentials. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.