Improper handling of exceptional conditions in Apache CXF
Priority MEDIUM 46CWE-755Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 10 fixed, 1 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
It is possible to configure Apache CXF to use the com.sun.net.ssl implementation via 'System.setProperty("java.protocol.handler.pkgs", "com.sun.net.ssl.internal.www.protocol");'. When this system property is set, CXF uses some reflection to try to make the HostnameVerifier work with the old com.sun.net.ssl.HostnameVerifier interface. However, the default HostnameVerifier implementation in CXF does not implement the method in this interface, and an exception is thrown. However, in Apache CXF prior to 3.2.5 and 3.1.16 the exception is caught in the reflection code and not properly propagated. What this means is that if you are using the com.sun.net.ssl stack with CXF, an error with TLS hostname verification will not be thrown, leaving a CXF client subject to man-in-the-middle attacks.
Why it matters now
EPSS 0.08507 95th percentileScored 2026-11-07
Fix Partial Apache CXF (Apache Software Foundation): 3.1.16, 3.2.5org.apache.cxf:cxf-rt-transports-http (Maven): 3.2.5, 3.1.16+1 more productRed Hat: 10 advisoriesRed Hat: 10 fixed, 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache CXF | before 3.1.16; 3.2 to before 3.2.5 | 3.1.16, 3.2.5 | Patch available | CNA |
| — | org.apache.cxf:cxf-rt-transports-http (Maven) | 3.2.0 to before 3.2.5 | 3.2.5 | Patch available | GHSA-jc7r-v6fg-2gpf |
| — | org.apache.cxf:cxf-rt-transports-http (Maven) | before 3.1.16 | 3.1.16 | Patch available | GHSA-jc7r-v6fg-2gpf |
| — | org.apache.cxf:apache-cxf (Maven) | 3.2.0 to before 3.2.5 | 3.2.5 | Patch available | GHSA-jc7r-v6fg-2gpf |
| — | org.apache.cxf:apache-cxf (Maven) | before 3.1.16 | 3.1.16 | Patch available | GHSA-jc7r-v6fg-2gpf |
- Apache CXF VendorApache Affected before 3.1.16; 3.2 to before 3.2.5 Fixed in 3.1.16, 3.2.5 Patch available CNA
- org.apache.cxf:cxf-rt-transports-http (Maven) Vendor— Affected 3.2.0 to before 3.2.5 Fixed in 3.2.5 Patch available GHSA-jc7r-v6fg-2gpf
- org.apache.cxf:cxf-rt-transports-http (Maven) Vendor— Affected before 3.1.16 Fixed in 3.1.16 Patch available GHSA-jc7r-v6fg-2gpf
- org.apache.cxf:apache-cxf (Maven) Vendor— Affected 3.2.0 to before 3.2.5 Fixed in 3.2.5 Patch available GHSA-jc7r-v6fg-2gpf
- org.apache.cxf:apache-cxf (Maven) Vendor— Affected before 3.1.16 Fixed in 3.1.16 Patch available GHSA-jc7r-v6fg-2gpf
Remediation
- Fix · CNA Apache CXF (Apache Software Foundation) Fixed in 3.1.16, 3.2.5
- Fix · GHSA-jc7r-v6fg-2gpf org.apache.cxf:cxf-rt-transports-http (Maven) Fixed in 3.2.5 Advisory →
- Fix · GHSA-jc7r-v6fg-2gpf org.apache.cxf:cxf-rt-transports-http (Maven) Fixed in 3.1.16 Advisory →
- Fix · GHSA-jc7r-v6fg-2gpf org.apache.cxf:apache-cxf (Maven) Fixed in 3.2.5 Advisory →
- Fix · GHSA-jc7r-v6fg-2gpf org.apache.cxf:apache-cxf (Maven) Fixed in 3.1.16 Advisory →
Red Hat 10 advisories
- RHSA-2018:3817 Released 2018-12-11 · Red Hat rating ImportantRed Hat JBoss Fuse/A-MQ 6.3 R10 security and bug fix update
- Red Hat JBoss A-MQ 6.3
- Red Hat JBoss Fuse 6.3
- RHSA-2018:3768 Released 2018-12-04 · Red Hat rating ImportantRed Hat Fuse 7.2 security update
- Red Hat Fuse 7.2
- RHSA-2018:2643 Released 2018-09-04 · Red Hat rating Importantrhvm-appliance security update
- Red Hat Virtualization 4 Hypervisor for RHEL 7 rhvm-appliance-2:4.2-20180828.0.el7
- Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts rhvm-appliance-2:4.2-20180828.0.el7
Show 7 more Red Hat advisories
- RHSA-2018:2424 Released 2018-08-15 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.1.4 on RHEL7 security update
- Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server eap7-activemq-artemis-1.5.5.013-1.redhat_1.1.ep7.el7, eap7-activemq-artemis-cli-1.5.5.013-1.redhat_1.1.ep7.el7, eap7-activemq-artemis-commons-1.5.5.013-1.redhat_1.1.ep7.el7 +47
- RHSA-2018:2423 Released 2018-08-15 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.1.4 on RHEL 6 security update
- Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server eap7-activemq-artemis-1.5.5.013-1.redhat_1.1.ep7.el6, eap7-activemq-artemis-cli-1.5.5.013-1.redhat_1.1.ep7.el6, eap7-activemq-artemis-commons-1.5.5.013-1.redhat_1.1.ep7.el6 +47
- RHSA-2018:2428 Released 2018-08-15 · Red Hat rating ImportantRed Hat Single Sign-On 7.2.4 security update
- Red Hat Single Sign-On 7.2.4 zip
- RHSA-2018:2425 Released 2018-08-15 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.1 security update
- Red Hat JBoss EAP 7.1
- RHSA-2018:2279 Released 2018-07-26 · Red Hat rating ImportantRed Hat Single Sign-On 7.2 security update
- Red Hat Single Sign-On 7.2
- RHSA-2018:2276 Released 2018-07-26 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.1 security update
- Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server eap7-apache-cxf-3.1.16-1.redhat_1.1.ep7.el6, eap7-apache-cxf-rt-3.1.16-1.redhat_1.1.ep7.el6, eap7-apache-cxf-services-3.1.16-1.redhat_1.1.ep7.el6 +11
- Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server eap7-apache-cxf-3.1.16-1.redhat_1.1.ep7.el7, eap7-apache-cxf-rt-3.1.16-1.redhat_1.1.ep7.el7, eap7-apache-cxf-services-3.1.16-1.redhat_1.1.ep7.el7 +11
- RHSA-2018:2277 Released 2018-07-26 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.1 security update
- Red Hat JBoss EAP 7.1
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift Application Runtimes | Affected | No fix yet |
| Red Hat Fuse 7.2 | Fixed | RHSA-2018:3768 |
| Red Hat JBoss A-MQ 6.3 | Fixed | RHSA-2018:3817 |
| Red Hat JBoss EAP 7.1 | Fixed | RHSA-2018:2277 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server | Fixed | RHSA-2018:2276, RHSA-2018:2423 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server | Fixed | RHSA-2018:2276, RHSA-2018:2424 |
| Red Hat JBoss Fuse 6.3 | Fixed | RHSA-2018:3817 |
| Red Hat Single Sign-On 7.2 | Fixed | RHSA-2018:2279 |
| Red Hat Single Sign-On 7.2.4 zip | Fixed | RHSA-2018:2428 |
| Red Hat Virtualization 4 Hypervisor for RHEL 7 | Fixed | RHSA-2018:2643 |
| Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts | Fixed | RHSA-2018:2643 |
Not affected: 6 products
- Logging Subsystem for Red Hat OpenShift
- Red Hat BPM Suite 6
- Red Hat JBoss BRMS 6
- Red Hat JBoss Data Virtualization 6
- Red Hat JBoss Enterprise Application Platform 6
- Red Hat Single Sign-On 7
Timeline
- 2026-10-02 Threatist record created from CVE-2018-8039
- 2026-10-03 Alias added: GHSA-jc7r-v6fg-2gpf
- 2026-10-21 EPSS moved to the 95th–99th percentile
References
Advisory 13
- RHSA-2018:2428
- RHSA-2018:3817
- RHSA-2018:2643
- RHSA-2018:2279
- RHSA-2018:2424
- RHSA-2018:2276
- RHSA-2018:2423
- RHSA-2018:2425
- RHSA-2018:2277
- http://cxf.apache.org/security-advisories.data/CVE-2018-8039.txt.asc?version=1&modificationDate=1530184663000&api=v2
- RHSA-2018:3768
- https://nvd.nist.gov/vuln/detail/CVE-2018-8039
- https://github.com/advisories/GHSA-jc7r-v6fg-2gpf
Other 20
- [cxf-user] 20180628 Apache CXF 3.2.6 and 3.1.16 are released
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- https://www.oracle.com/security-alerts/cpujan2020.html
- [cxf-commits] 20200116 svn commit: r1055336 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2019-12423.txt.asc security-advisories.data/CVE-2019-17573.txt.asc security-advisories.html
- [cxf-commits] 20200319 svn commit: r1058035 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2019-17573.txt.asc security-advisories.html
- [cxf-commits] 20200401 svn commit: r1058573 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2020-1954.txt.asc security-advisories.html
- https://www.oracle.com/security-alerts/cpuapr2020.html
- [cxf-commits] 20201112 svn commit: r1067927 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2020-13954.txt.asc security-advisories.html
- [cxf-commits] 20210402 svn commit: r1073270 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2021-22696.txt.asc security-advisories.html
- [cxf-commits] 20210616 svn commit: r1075801 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2021-30468.txt.asc security-advisories.html
- https://github.com/apache/cxf/commit/8ed6208f987ff72e4c4d2cf8a6b1ec9b27575d4
- https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4@%3Ccommits.cxf.apache.org%3E
- https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e@%3Ccommits.cxf.apache.org%3E
- https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4@%3Ccommits.cxf.apache.org%3E
- https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6@%3Ccommits.cxf.apache.org%3E
- https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c@%3Ccommits.cxf.apache.org%3E
- https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf@%3Ccommits.cxf.apache.org%3E
- https://lists.apache.org/thread.html/1f8ff31df204ad0374ab26ad333169e0387a5e7ec92422f337431866@%3Cdev.cxf.apache.org%3E
- https://github.com/apache/cxf
- https://cxf.apache.org/security-advisories.data/CVE-2018-8039.txt.asc
More Apache Cxf vulnerabilities
- TI-2019-09264 Incorrect authorization in Apache CXF CVSS 3.1CRITICAL 9.8
- TI-2020-10930 Apache CXF Reflected XSS in the services listing page via the styleSheetPath CVSS 3.1MEDIUM 6.1
- TI-2010-01990 Apache CXF 2.0.x before 2.0.13, 2.1.x before 2.1.10, and 2.2.x before 2.2.9, as used in… CVSS 3.1CRITICAL 9.8
- TI-2022-22907 Apache CXF SSRF Vulnerability CVSS 3.1CRITICAL 9.8
- TI-2026-47481 Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage CVSS 3.1CRITICAL 9.8
- TI-2025-31053 Apache CXF: Untrusted JMS configuration can lead to RCE CVSS 3.1CRITICAL 9.8
Sources
- CVE-2018-8039 · CVE Program
- CVE-2018-8039 · NVD
- FIRST EPSS
- GHSA-jc7r-v6fg-2gpf · GitHub Advisory Database · CC BY 4.0
- CVE-2018-8039 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences