CVE-2026-107938 Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification.

In Apache CXF, the Netty-based HTTP client transport cxf-rt-transports-http-netty-client did not verify that the hostname in the server’s TLS certificate matched the host being called. This applied over both HTTP/1.1 and HTTP/2, even when disableCNCheck was left at its default value of false. The...

PT-2026-80244

Summary The HTTP client transport in mcp/sdk reads a Server-Sent-Events SSE response stream incrementally and appends each 4 KiB chunk to an in-memory buffer $this-sseBuffer .= $chunk; with no upper bound. The buffer is only ever flushed when an SSE event delimiter " " appears. A remote MCP serve...

org.eclipse.jetty.documentation:jetty-documentation (>=10.0.8, <=10.0.19), org.eclipse.jetty.http3:http3-client (>=10.0.8, <=10.0.19) +5 more potentially affected by CVE-2024-22201 via org.eclipse.jetty.http3:http3-common (>=10.0.8, <=10.0.19)

org.eclipse.jetty.http3:http3-common MAVEN version =10.0.8, =10.0.8, =10.0.8, =10.0.8, =10.0.8, =10.0.8, =10.0.10, =5.26.1, =5.27.4 Source cves: CVE-2024-22201 Source advisory: OSV:GHSA-RGGV-CV7R-MW98...

org.eclipse.jetty.documentation:jetty-documentation (>=10.0.8, <=10.0.19), org.eclipse.jetty.http3:http3-client (>=10.0.8, <=10.0.19) +5 more potentially affected by CVE-2024-22201 via org.eclipse.jetty.http3:http3-common (>=10.0.8, <=10.0.19)

org.eclipse.jetty.http3:http3-common MAVEN version =10.0.8, =10.0.8, =10.0.8, =10.0.8, =10.0.8, =10.0.8, =10.0.10, =5.26.1, =5.27.4 Source cves: CVE-2024-22201 Source advisory: GHSA-RGGV-CV7R-MW98...

org.eclipse.jetty.documentation:jetty-documentation (>=10.0.8, <=10.0.19), org.eclipse.jetty.http3:http3-client (>=10.0.8, <=10.0.19) +5 more potentially affected by CVE-2024-22201 via org.eclipse.jetty.http3:http3-common (>=10.0.8, <=10.0.19)

org.eclipse.jetty.http3:http3-common MAVEN version =10.0.8, =10.0.8, =10.0.8, =10.0.8, =10.0.8, =10.0.8, =10.0.10, =5.26.1, =5.27.4 Source cves: CVE-2024-22201 Source advisory: MEND:CVE-2024-22201...