GHSA-73m2-qfq3-56cxHighCVSS 7.5

Apache HttpClient disables domain checks

Published
April 24, 2025
Last Modified
May 17, 2025

🔗 CVE IDs covered (1)

CVE-2025-27820 →

📋 Description

A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification. Discovered by the Apache HttpClient team. Fixed in the 5.4.3 release.

🎯 Affected products1

  • maven/org.apache.httpcomponents.client5:httpclient5:>= 5.4-alpha1, < 5.4.3

🔗 References (7)