CLEANSTART-2026-YB05084 In Apache CXF, the Netty-based HTTP client transport (cxf-rt-transports-http-netty-client) did not verify that the hostname in the server’s TLS certificate matched the host being called

Security vulnerability affects the wildfly package. In Apache CXF, the Netty-based HTTP client transport cxf-rt-transports-http-netty-client did not verify that the hostname in the server’s TLS certificate matched the host being called...

CVE-2026-107938

In Apache CXF, the Netty-based HTTP client transport cxf-rt-transports-http-netty-client did not verify that the hostname in the server’s TLS certificate matched the host being called. This applied over both HTTP/1.1 and HTTP/2, even when disableCNCheck was left at its default value of false. The...

org.apache.cxf:apache-cxf (>=4.2.0, <=4.2.3), org.apache.cxf:cxf-distribution-manifest (>=4.2.0, <=4.2.3) potentially affected by CVE-2026-107938 via org.apache.cxf:cxf-rt-transports-http-netty-client (>=4.2.0, <=4.2.3)

org.apache.cxf:cxf-rt-transports-http-netty-client MAVEN version =4.2.0, =4.2.0, =4.2.0, =4.2.3 Source cves: CVE-2026-107938 Source advisory: MEND:CVE-2026-107938...

CVE-2026-107938

In Apache CXF, the Netty-based HTTP client transport cxf-rt-transports-http-netty-client did not verify that the hostname in the server’s TLS certificate matched the host being called. This applied over both HTTP/1.1 and HTTP/2, even when disableCNCheck was left at its default value of false. The...

EUVD-2026-95703

In Apache CXF, the Netty-based HTTP client transport cxf-rt-transports-http-netty-client did not verify that the hostname in the server’s TLS certificate matched the host being called. This applied over both HTTP/1.1 and HTTP/2, even when disableCNCheck was left at its default value of false. The...

CVE-2026-107938

The Apache CXF Netty-based HTTP client transport (cxf-rt-transports-http-netty-client ) fails to verify that the hostname in a server's TLS certificate matches the host being called. This flaw impacts both HTTP/1.1 and HTTP/2 protocols, even when the disableCNCheck parameter is set to its default...

CVE-2026-107938 Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification.

In Apache CXF, the Netty-based HTTP client transport cxf-rt-transports-http-netty-client did not verify that the hostname in the server’s TLS certificate matched the host being called. This applied over both HTTP/1.1 and HTTP/2, even when disableCNCheck was left at its default value of false. The...

CVE-2026-107938 Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification.

In Apache CXF, the Netty-based HTTP client transport cxf-rt-transports-http-netty-client did not verify that the hostname in the server’s TLS certificate matched the host being called. This applied over both HTTP/1.1 and HTTP/2, even when disableCNCheck was left at its default value of false. The...

CVE-2026-107938 Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification.

In Apache CXF, the Netty-based HTTP client transport cxf-rt-transports-http-netty-client did not verify that the hostname in the server’s TLS certificate matched the host being called. This applied over both HTTP/1.1 and HTTP/2, even when disableCNCheck was left at its default value of false. The...

org.apache.cxf.systests:cxf-systests-transport-netty (>=3.5.7, <=3.6.3), org.apache.cxf:apache-cxf (>=3.0.0, <=3.6.12) +1 more potentially affected by CVE-2026-107938 via org.apache.cxf:cxf-rt-transports-http-netty-client (>=3.0.0, <=3.6.12)

org.apache.cxf:cxf-rt-transports-http-netty-client MAVEN version =3.0.0, =3.5.7, =3.0.0, =3.0.0, =3.6.12 Source cves: CVE-2026-107938 Source advisory: MEND:CVE-2026-107938...

kr.jclab.wsman:abstract-wsman (>=0.0.1-rc2, <=0.0.1-rc4), kr.jclab.wsman:abstract-wsman-netty (>=0.0.2-rc1, <=0.0.4) +3 more potentially affected by CVE-2026-107938 via org.apache.cxf:cxf-rt-transports-http-netty-client (>=4.0.0, <=4.1.8)

org.apache.cxf:cxf-rt-transports-http-netty-client MAVEN version =4.0.0, =0.0.1-rc2, =0.0.2-rc1, =4.0.2, =4.0.0, =4.0.0, =4.1.8 Source cves: CVE-2026-107938 Source advisory: MEND:CVE-2026-107938...

CVE-2026-107938: Improper Validation of Certificate with Host Mismatch

In Apache CXF, the Netty-based HTTP client transport cxf-rt-transports-http-netty-client did not verify that the hostname in the server’s TLS certificate matched the host being called. This applied over both HTTP/1.1 and HTTP/2, even when disableCNCheck was left at its default value of false. The...

PT-2026-108812

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.4 Apache CXF versions prior to 4.1.9 Apache CXF versions prior to 3.6.13 Description The Netty-based HTTP client transport cxf-rt-transports-http-netty-client fails to verify that the hostname in the server TLS...

Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks

Summary Netty's OcspClient does not validate that the CertificateID in an OCSP response matches the requested CertificateID. A bad actor can replay a GOOD status response issued for an unrelated certificate by the same CA to bypass revocation checks for any certificate. Details...

GHSA-PFC9-2CQG-9WQ6 Reactor Netty HTTP Client Leaks Credentials On Protocol Downgrade Redirect

In specific scenarios involving HTTP redirects from a secure to an insecure endpoint, the Reactor Netty HTTP client may leak credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects. Affected versions: Reactor Netty 1.0.0 through 1.0.51;...

cve-2026-41715 - MEDIUM - Reactor Netty HTTP Client Leaks Credentials On Protocol Downgrade Redirect

cve-2026-41715 - MEDIUM - Reactor Netty HTTP Client Leaks Credentials On Protocol Downgrade Redirect...