GHSA-73m2-qfq3-56cx

Apache HttpClient disables domain checks

En bref

Publiée: 2025-04-24 12:31 UTC
Mise à jour: 2026-09-10 03:50 UTC
CVE: CVE-2025-27820
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Description

A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification. Discovered by the Apache HttpClient team. Fixed in the 5.4.3 release.

Paquets affectés

Paquet	Versions
Maven · org.apache.httpcomponents.client5:httpclient5	introduced 5.4-alpha1, fixed 5.4.3

Références

https://nvd.nist.gov/vuln/detail/CVE-2025-27820 ADVISORY
https://github.com/apache/httpcomponents-client/pull/574 WEB
https://github.com/apache/httpcomponents-client/pull/621 WEB
https://github.com/apache/httpcomponents-client PACKAGE
https://hc.apache.org/httpcomponents-client-5.4.x/index.html WEB
https://lists.apache.org/thread/55xhs40ncqv97qvoocok44995xp5kqn8 WEB
https://security.netapp.com/advisory/ntap-20250516-0003 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database