CVE search · CVE-2025-27820
CVE-2025-27820
high 7.5
A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification. Discovered by the Apache HttpClient team. Fixed in the 5.4.3 release
Details
- Status
- Analyzed
- Published
- Last changed
- Source
- security@apache.org
- Weakness
- CWE-295
Severity
| Version | Score | Vector | Source |
|---|---|---|---|
| CVSS 3.1 | high 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
134c704f-9b21-4f2e-91b3-4a467353bcc0Secondary |
Affected products
Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.
References
- https://github.com/apache/httpcomponents-client/pull/574Issue TrackingPatch
- https://github.com/apache/httpcomponents-client/pull/621Issue TrackingPatch
- https://hc.apache.org/httpcomponents-client-5.4.x/index.htmlProduct
- https://lists.apache.org/thread/55xhs40ncqv97qvoocok44995xp5kqn8Mailing ListPatch
- https://security.netapp.com/advisory/ntap-20250516-0003/Third Party Advisory