apache/httpcomponents-client · Security
Apache HttpClient disables domain checks
- GHSA ID
- GHSA-73m2-qfq3-56cx
- CVE ID
- CVE-2025-27820
- Severity
- high
- Published
- Updated
- CVSS
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- CVSS v3
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Description
A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification. Discovered by the Apache HttpClient team. Fixed in the 5.4.3 release.
CWEs
- CWE-295 · Improper Certificate Validation
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-27820 ↗
- https://github.com/apache/httpcomponents-client/pull/574 ↗
- https://github.com/apache/httpcomponents-client/pull/621 ↗
- https://hc.apache.org/httpcomponents-client-5.4.x/index.html ↗
- https://lists.apache.org/thread/55xhs40ncqv97qvoocok44995xp5kqn8 ↗
- https://security.netapp.com/advisory/ntap-20250516-0003 ↗
- https://github.com/advisories/GHSA-73m2-qfq3-56cx ↗