Bug 2548459 (CVE-2026-107938)

Summary: CVE-2026-107938 org.apache.cxf/cxf-rt-transports-http-netty-client: Apache CXF: Information disclosure via missing TLS hostname verification
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: fmariani, gmalinko, janstey, jwon, mcarlett, pdelbell, pjindal, rstepani, tcunning, yfang
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Apache CXF's Netty-based HTTP client transport. This flaw enables information disclosure because the client fails to verify that the server's identity matches the host name in the Transport Layer Security (TLS) certificate. A network attacker capable of intercepting traffic could exploit this issue by presenting a certificate for a domain they control that is trusted by the client's trust store. Successful exploitation allows the attacker to impersonate the target service and intercept or alter sensitive communications, including authentication credentials.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-09 10:31:42 UTC 
In Apache CXF, the Netty-based HTTP client transport (cxf-rt-transports-http-netty-client) did not verify that the hostname in the server’s TLS certificate matched the host being called. This applied over both HTTP/1.1 and HTTP/2, even when disableCNCheck was left at its default value of false. The certificate chain was validated against the configured trust store, but the endpoint’s identity was not. A network attacker able to intercept traffic could present any certificate trusted by the client, such as a publicly issued certificate for a domain they control, and impersonate the target service. They could then read or modify the exchanged messages, including credentials. 
Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.