CVE-2026-107938, CVE-2026-71575, CVE-2026-100227

Data: 2026-10-17

Severity: Critical

CVSS Score:

• CVE-2026-107938: 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)

• CVE-2026-71575: 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)

• CVE-2026-100227: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

Riferimenti:

• CVE-2026-107938:

  • https://nvd.nist.gov/vuln/detail/CVE-2026-107938

  • https://cxf.apache.org/security-advisories.data/CVE-2026-107938.txt

• CVE-2026-71575:

  • https://nvd.nist.gov/vuln/detail/CVE-2026-71575

  • https://cxf.apache.org/security-advisories.data/CVE-2026-71575.txt

• CVE-2026-100227:

  • https://nvd.nist.gov/vuln/detail/CVE-2026-100227

  • https://cxf.apache.org/security-advisories.data/CVE-2026-100227.txt

Libreria: org.apache.cxf:cxf-rt-transports-http-netty-client, org.apache.cxf:cxf-rt-rs-security-sso-oidc, org.apache.cxf:cxf-rt-rs-security-xml (versioni affette: < 3.6.13, 4.0.0 - 4.1.8 e 4.2.0 - 4.2.3)

Descrizione

Le tre vulnerabilità riguardano moduli opzionali di Apache CXF: il trasporto HTTP client basato su Netty, il relying party OpenID Connect e il modulo XML Security per i servizi JAX-RS.

1. [CVE-2026-107938] CWE-297: Improper Validation of Certificate with Host Mismatch

In Apache CXF, the Netty-based HTTP client transport (cxf-rt-transports-http-netty-client) did not verify that the hostname in the server’s TLS certificate matched the host being called. This applied over both HTTP/1.1 and HTTP/2, even when disableCNCheck was left at its default value of false. The certificate chain was validated against the configured trust store, but the endpoint’s identity was not. A network attacker able to intercept traffic could present any certificate trusted by the client, such as a publicly issued certificate for a domain they control, and impersonate the target service. They could then read or modify the exchanged messages, including credentials. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.

2. [CVE-2026-71575] CWE-613: Insufficient Session Expiration

The max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted comparison polarity. Any relying party using setMaxAgeOffset to enforce re-authentication would silently accept sessions of any age, bypassing step-up authentication policies. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.

3. [CVE-2026-100227] CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (“Race Condition”)

Improper Verification of Cryptographic Signature vulnerability in Apache CXF’s JAX-RS XML Security module. The JAX-RS XML Signature interceptors (XmlSigInHandler, XmlSigInInterceptor and the streaming XmlSecInInterceptor) did not ensure that the XML passed to the application was covered by the signature. An attacker with any document signed by a trusted key could wrap it in unsigned content, which the application would then treat as signed. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.

GovWay

Le tre vulnerabilità risiedono in moduli di Apache CXF che non fanno parte della distribuzione di GovWay:

• CVE-2026-107938 riguarda il trasporto HTTP client basato su Netty (modulo cxf-rt-transports-http-netty-client). Le invocazioni verso i backend e gli altri domini effettuate dal gateway sono realizzate tramite i connettori propri del prodotto, che non utilizzano i trasporti client di Apache CXF; gli stub client CXF forniti con GovWay (es. IntegrationManager) utilizzano invece il trasporto HTTP standard di CXF (cxf-rt-transports-http), non interessato dalla vulnerabilità;

• CVE-2026-71575 riguarda il filtro OidcClientCodeRequestFilter del relying party OpenID Connect di CXF (modulo cxf-rt-rs-security-sso-oidc). L’autenticazione degli utenti delle console e la gestione dei token in GovWay (validazione JWT, introspection e userinfo verso Identity Provider esterni, negoziazione dei token, PDND) sono realizzate con logica propria, indipendente dai moduli OAuth2/OIDC di CXF (cfr. CVE-2026-68079, CVE-2026-61466, CVE-2026-63687, CVE-2026-65583, CVE-2026-57817, CVE-2026-57818, CVE-2026-68481);

• CVE-2026-100227 riguarda gli interceptor di firma XML per JAX-RS (XmlSigInHandler, XmlSigInInterceptor, XmlSecInInterceptor) del modulo cxf-rt-rs-security-xml. Le API REST esposte da GovWay tramite CXF (API di configurazione e monitoraggio) non utilizzano firme XML, mentre la verifica delle firme XML sui messaggi gestiti dal gateway (WS-Security, ModI) è effettuata tramite WSS4J e logica propria del prodotto, senza transitare per gli interceptor JAX-RS di CXF.

Per questi motivi le vulnerabilità non si manifestano nel prodotto.

La libreria viene comunque aggiornata alla prima versione in rilascio.

Versione affette:

• 3.3.x: <= 3.3.20

• 3.4.x: <= 3.4.3

Risoluzione:

• 3.3.x: 3.3.21

• 3.4.x: 3.4.4