CVE-2018-8039: Apache CXF TLS Hostname Verification Bypass
Summary
CVE-2018-8039: Apache CXF TLS hostname verification does not work correctly with com.sun.net.ssl.*. Affects org.apache.cxf:cxf-rt-transports-http across 2 version ranges.
< 3.1.16
>= 3.2.0, < 3.2.5
Fixed in 3.1.16 or 3.2.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache CXF is an open-source web services framework that helps developers build and deploy services using various protocols like SOAP, REST, and more. It provides a comprehensive set of tools and libraries for creating and consuming web services. However, a vulnerability in Apache CXF versions prior to 3.2.5 and 3.1.16 allows for TLS hostname verification bypass, potentially exposing clients to man-in-the-middle attacks.
Vulnerability Detail
The vulnerability arises when Apache CXF is configured to use the com.sun.net.ssl implementation via the 'java.protocol.handler.pkgs' system property. In this configuration, CXF attempts to make the HostnameVerifier work with the old com.sun.net.ssl.HostnameVerifier interface using reflection. However, the default HostnameVerifier implementation in CXF does not implement the required method in this interface, leading to an exception. Unfortunately, prior to the fixed versions, this exception is caught in the reflection code and not properly propagated. As a result, when using the com.sun.net.ssl stack with CXF, TLS hostname verification errors are not thrown, leaving the CXF client vulnerable to man-in-the-middle attacks.
How To Fix
Latest published version: 4.2.4 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 3.1.163.1.16 -
>= 3.2.0, < 3.2.53.2.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the fixed versions is not immediately feasible, a possible workaround is to avoid using the com.sun.net.ssl implementation with Apache CXF. Instead, consider using a different SSL implementation that is compatible with CXF and does not exhibit this vulnerability. This can be achieved by not setting the 'java.protocol.handler.pkgs' system property to 'com.sun.net.ssl.internal.www.protocol' or by removing the property altogether.
Conclusion
The vulnerability in Apache CXF versions prior to 3.2.5 and 3.1.16 allows for TLS hostname verification bypass, potentially exposing clients to man-in-the-middle attacks. To mitigate this vulnerability, it is recommended to upgrade to the fixed versions or use a different SSL implementation. Vulert's playground can be used to check if your application is affected by this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.cxf:cxf-rt-transports-http →
FAQ
Apache CXF is an open-source web services framework that allows developers to build and deploy services using various protocols like SOAP, REST, and more.
TLS hostname verification is a security mechanism that ensures the hostname of the server being connected to matches the expected hostname. It helps prevent man-in-the-middle attacks by verifying the identity of the server.
This vulnerability affects Apache CXF users who are using the com.sun.net.ssl implementation and have configured the 'java.protocol.handler.pkgs' system property. It allows for TLS hostname verification bypass, potentially exposing clients to man-in-the-middle attacks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using just the pom.xml file, without requiring access to the code or installation.
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.cxf:cxf-rt-transports-http.
