GHSA-73m2-qfq3-56cx
Apache HttpClient disables domain checks
At a glance
- Published
- Updated
- CVE
- CVE-2025-27820
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Description
A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification. Discovered by the Apache HttpClient team. Fixed in the 5.4.3 release.
Affected packages
| Package | Versions |
|---|---|
| Maven · org.apache.httpcomponents.client5:httpclient5 | introduced 5.4-alpha1, fixed 5.4.3 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-27820 ADVISORY
- https://github.com/apache/httpcomponents-client/pull/574 WEB
- https://github.com/apache/httpcomponents-client/pull/621 WEB
- https://github.com/apache/httpcomponents-client PACKAGE
- https://hc.apache.org/httpcomponents-client-5.4.x/index.html WEB
- https://lists.apache.org/thread/55xhs40ncqv97qvoocok44995xp5kqn8 WEB
- https://security.netapp.com/advisory/ntap-20250516-0003 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |