CVE-2026-107938

In Apache CXF, the Netty-based HTTP client transport cxf-rt-transports-http-netty-client did not verify that the hostname in the server’s TLS certificate matched the host being called. This applied over both HTTP/1.1 and HTTP/2, even when disableCNCheck was left at its default value of false. The...

CVE-2026-107938 Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification.

In Apache CXF, the Netty-based HTTP client transport cxf-rt-transports-http-netty-client did not verify that the hostname in the server’s TLS certificate matched the host being called. This applied over both HTTP/1.1 and HTTP/2, even when disableCNCheck was left at its default value of false. The...

EUVD-2026-95703

In Apache CXF, the Netty-based HTTP client transport cxf-rt-transports-http-netty-client did not verify that the hostname in the server’s TLS certificate matched the host being called. This applied over both HTTP/1.1 and HTTP/2, even when disableCNCheck was left at its default value of false. The...

CVE-2026-107938

The Apache CXF Netty-based HTTP client transport (cxf-rt-transports-http-netty-client ) fails to verify that the hostname in a server's TLS certificate matches the host being called. This flaw impacts both HTTP/1.1 and HTTP/2 protocols, even when the disableCNCheck parameter is set to its default...

PT-2026-108812

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.4 Apache CXF versions prior to 4.1.9 Apache CXF versions prior to 3.6.13 Description The Netty-based HTTP client transport cxf-rt-transports-http-netty-client fails to verify that the hostname in the server TLS...

CVE-2026-107938: Improper Validation of Certificate with Host Mismatch

In Apache CXF, the Netty-based HTTP client transport cxf-rt-transports-http-netty-client did not verify that the hostname in the server’s TLS certificate matched the host being called. This applied over both HTTP/1.1 and HTTP/2, even when disableCNCheck was left at its default value of false. The...

Important: Red Hat Security Advisory: Red Hat Build of Apache Camel 4.4.2 for Spring Boot security update.

Red Hat build of Apache Camel 4.4.2 for Spring Boot release and security update is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...

Security Bulletin: Vulnerability found in cxf-rt-transports-http-3.5.3.jar which is shipped with IBM® Intelligent Operations Center(CVE-2022-46363)

Summary Vulnerability have been identified in cxf-rt-transports-http-3.5.3.jar which is shipped with IBM® Intelligent Operations Center. Information about this vulnerability affecting IBM® Intelligent Operations Center have been published and addressed the applicable CVEs. Vulnerability Details...

br.com.esec.icpm:certillion-client-library (>=1.1.7, <=1.2.0), br.com.esec.icpm:certillion-client-library-resteasy-plugin (>=1.1.9, <=1.1.10) +121 more potentially affected by CVE-2012-5575 via org.apache.cxf:cxf-rt-transports-http (>=2.7.0, <=2.7.3)

org.apache.cxf:cxf-rt-transports-http MAVEN version =2.7.0, =1.1.7, =1.1.9, =1.2.5, =0.4.0, =0.4.1, =1.3.1, =1.2.3, =1.2.3, =1.4.0, =1.4.0, =1.4.0, =1.5.0 and more Source cves: CVE-2012-5575 Source advisory: OSV:GHSA-7V5V-9V8R-W864...

br.com.esec.icpm:certillion-client-library (>=1.1.7, <=1.2.0), br.com.esec.icpm:certillion-client-library-resteasy-plugin (>=1.1.9, <=1.1.10) +121 more potentially affected by CVE-2012-5575 via org.apache.cxf:cxf-rt-transports-http (>=2.7.0, <=2.7.3)

org.apache.cxf:cxf-rt-transports-http MAVEN version =2.7.0, =1.1.7, =1.1.9, =1.2.5, =0.4.0, =0.4.1, =1.3.1, =1.2.3, =1.2.3, =1.4.0, =1.4.0, =1.4.0, =1.5.0 and more Source cves: CVE-2012-5575 Source advisory: GHSA-7V5V-9V8R-W864...

Cross-Site Scripting (XSS)

cxf-rt-transports-http is vulnerable to cross-site scripting XSS. An attacker is able to inject and execute arbitrary Javascript in a user's browser via the stykeSheetPath parameter...

Cross-Site Scripting (XSS)

cxf-rt-transports-http is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a user's browser via an endpoint addresses and URL...

de.mhus.osgi.tutorial:ws-server (>=1.0.3, <=1.0.5), org.apache.cxf.services.sts:cxf-services-sts-core (2.7.9) +31 more potentially affected by CVE-2018-8039 via org.apache.cxf:cxf-rt-transports-http (2.7.9)

org.apache.cxf:cxf-rt-transports-http MAVEN version 2.7.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-transports-http and may be impacted: - de.mhus.osgi.tutorial:ws-server =1.0.3, =1.0.5 -...

com.opnworks.maven:artifactory-maven-plugin (1.0.1), nz.ac.auckland.composite:composite-cxf (3.2) +49 more potentially affected by CVE-2018-8039 via org.apache.cxf:cxf-rt-transports-http (2.7.4)

org.apache.cxf:cxf-rt-transports-http MAVEN version 2.7.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-transports-http and may be impacted: - com.opnworks.maven:artifactory-maven-plugin 1.0.1 -...

com.gitlab.java-ebms-adapter:ebms-adapter-web (2.15.2-mic), net.winroad:wrdoclet-demoservice (>=1.0.2, <=1.1.0) +94 more potentially affected by CVE-2018-8039 via org.apache.cxf:cxf-rt-transports-http (2.7.14)

org.apache.cxf:cxf-rt-transports-http MAVEN version 2.7.14 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-transports-http and may be impacted: - com.gitlab.java-ebms-adapter:ebms-adapter-web 2.15.2-mic -...

com.atomikos:transactions-tcc-rest (>=4.0.0, <=4.0.3), net.stickycode.component:sticky-component-cxf (>=2.2, <=3.1) +54 more potentially affected by CVE-2018-8039 via org.apache.cxf:cxf-rt-transports-http (2.4.1)

org.apache.cxf:cxf-rt-transports-http MAVEN version 2.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-transports-http and may be impacted: - com.atomikos:transactions-tcc-rest =4.0.0, =2.2, =1.2, =3.1, =4.2 -...

com.feelercloud:esap-mesh (2.0.32), com.github.arucard21.simplyrestful:simplyrestful-jetty (0.5) +330 more potentially affected by CVE-2018-8039 via org.apache.cxf:cxf-rt-transports-http (>=3.2.0, <=3.2.4)

org.apache.cxf:cxf-rt-transports-http MAVEN version =3.2.0, =0.0.1, =1.0.3, =1.0.3, =1.0.0.release, =2.6.0, =2.0.0-m3, =1.3.0-release, =2.0.1-release - de.alpharogroup:gen-db-core 0.9.3 - de.alpharogroup:gen-db-sources 0.9.3 - de.alpharogroup:jpa-data-gen-maven-plugin 1.0.0 and more Source cves:...

org.apache.cxf:apache-cxf (2.0.11), org.apache.cxf:cxf-distribution-manifest (2.0.11) +5 more potentially affected by CVE-2018-8039 via org.apache.cxf:cxf-rt-transports-http (2.0.11)

org.apache.cxf:cxf-rt-transports-http MAVEN version 2.0.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-transports-http and may be impacted: - org.apache.cxf:apache-cxf 2.0.11 - org.apache.cxf:cxf-distribution-manifest 2.0.11 -...

org.apache.camel:camel-cxf (>=1.6.4, <=2.4.0), org.apache.camel:camel-example-cxf (>=1.6.4, <=2.4.0) +51 more potentially affected by CVE-2018-8039 via org.apache.cxf:cxf-rt-transports-http (2.2.9)

org.apache.cxf:cxf-rt-transports-http MAVEN version 2.2.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-transports-http and may be impacted: - org.apache.camel:camel-cxf =1.6.4, =1.6.4, =1.6.4, =1.6.4, =2.4.0 -...

org.apache.cxf.services.sts:cxf-services-sts-war (2.5.8), org.apache.cxf.systests:cxf-systests-ci-webapp (2.5.8) +24 more potentially affected by CVE-2018-8039 via org.apache.cxf:cxf-rt-transports-http (2.5.8)

org.apache.cxf:cxf-rt-transports-http MAVEN version 2.5.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-transports-http and may be impacted: - org.apache.cxf.services.sts:cxf-services-sts-war 2.5.8 -...