CVE-2026-107938
Description
A flaw was found in Apache CXF's Netty-based HTTP client transport. This flaw enables information disclosure because the client fails to verify that the server's identity matches the host name in the Transport Layer Security (TLS) certificate. A network attacker capable of intercepting traffic could exploit this issue by presenting a certificate for a domain they control that is trusted by the client's trust store. Successful exploitation allows the attacker to impersonate the target service and intercept or alter sensitive communications, including authentication credentials.
Statement
Red Hat has rated this vulnerability as Important rather than Critical because successful exploitation requires an adversary to occupy a privileged network position to intercept outbound connections, alongside obtaining a valid certificate from a trusted authority. In Red Hat environments, exposure is limited to integration workloads and applications explicitly configured to use Netty as their underlying HTTP client transport rather than default transports. In such configurations, missing endpoint identity verification allows adversaries to spoof destination servers and compromise the confidentiality and integrity of exchanged messages.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.4 | N/A | 9.1 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Understanding the Weakness (CWE)
Integrity,Authentication
Technical Impact: Bypass Protection Mechanism; Gain Privileges or Assume Identity
When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The product might connect to a malicious host while believing it is a trusted host, or the product might be deceived into accepting spoofed data that appears to originate from a trusted host.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
