CVE-2026-107938: Vulnerability in Apache Software Foundation Apache CXF
Description
In Apache CXF, the Netty-based HTTP client transport (cxf-rt-transports-http-netty-client) did not verify that the hostname in the server’s TLS certificate matched the host being called. This applied over both HTTP/1.1 and HTTP/2, even when disableCNCheck was left at its default value of false. The certificate chain was validated against the configured trust store, but the endpoint’s identity was not. A network attacker able to intercept traffic could present any certificate trusted by the client, such as a publicly issued certificate for a domain they control, and impersonate the target service. They could then read or modify the exchanged messages, including credentials. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.
Affected software
Apache Software Foundation
Apache CXF
pkg:maven/Apache Software Foundation/org.apache.cxf:cxf-rt-transports-http-netty-clientRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Apache CXF's Netty-based HTTP client transport (cxf-rt-transports-http-netty-client) involves a failure to verify the hostname in the server's TLS certificate against the host being called. Although the certificate chain was validated against the trust store, the endpoint identity was not checked, even when disableCNCheck was false. This affects both HTTP/1.1 and HTTP/2 protocols. An attacker capable of intercepting network traffic could present any certificate trusted by the client, such as a publicly issued certificate for a domain they control, to impersonate the target service and intercept or modify communications, including sensitive credentials. The issue is resolved in Apache CXF versions 4.2.4, 4.1.9, and 3.6.13.
Potential Impact
A network attacker who can intercept traffic may impersonate the target service by presenting a trusted certificate without proper hostname verification. This could lead to interception and modification of sensitive data, including credentials, compromising confidentiality and integrity of communications.
Mitigation Recommendations
Users should upgrade to Apache CXF versions 4.2.4, 4.1.9, or 3.6.13, which include fixes for this vulnerability. No other mitigation is indicated as the fix is officially available.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-10-09T09:19:43.226Z
- State
- PUBLISHED
Threat ID: 6ac8c31f2cdf04f6564c0cd4
Added to database: 10/09/2026, 10:34:07 UTC
Last enriched: 10/09/2026, 10:49:33 UTC
Last updated: 10/09/2026, 11:34:05 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.