high7.5
CVE-2025-27820
Apache HttpClient disables domain checks
Impact
A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification. Discovered by the Apache HttpClient team. Fixed in the 5.4.3 release.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.apache.httpcomponents.client5:httpclient5 | >= 5.4-alpha1, < 5.4.3 | 5.4.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Httpclient | from 5.4 before 5.4.3 |
| Netapp | Ontap Tools | Version 10 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/apache/httpcomponents-client/pull/574
- https://github.com/apache/httpcomponents-client/pull/621
- https://hc.apache.org/httpcomponents-client-5.4.x/index.html
- https://lists.apache.org/thread/55xhs40ncqv97qvoocok44995xp5kqn8
- https://security.netapp.com/advisory/ntap-20250516-0003/
- https://github.com/advisories/GHSA-73m2-qfq3-56cx
- https://nvd.nist.gov/vuln/detail/CVE-2025-27820
- https://security.netapp.com/advisory/ntap-20250516-0003