CVE-2025-27820: A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification

High severity · published Apr 24, 2025

CVE-2025-27820

A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification

7.5

CVSS

EPSS

On KEV

Description

A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification. Discovered by the Apache HttpClient team. Fixed in the 5.4.3 release

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

None

Integrity

High

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)1.0% · higher than 62% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Httpclient · Apache

5.4 before 5.4.3 · source: NVD

Ontap Tools · Netapp

10 · source: NVD

Affected product

Httpclient

Apache

All Httpclient CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2025-27820

CVE.org

https://www.cve.org/CVERecord?id=CVE-2025-27820

Issue Tracking

https://github.com/apache/httpcomponents-client/pull/574

Issue Tracking

https://github.com/apache/httpcomponents-client/pull/621

Product

https://hc.apache.org/httpcomponents-client-5.4.x/index.html

Mailing List

https://lists.apache.org/thread/55xhs40ncqv97qvoocok44995xp5kqn8

Third Party Advisory

https://security.netapp.com/advisory/ntap-20250516-0003/