CVEvulnerability
CVE-2025-27820
7.5 HIGH
Official page ↗
- Status
- Analyzed
- Published
- 2025-04-24
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Weaknesses
- CWE-295
Description
A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification. Discovered by the Apache HttpClient team. Fixed in the 5.4.3 release
Affected configurations
• apache httpclient (>= 5.4 < 5.4.3)
• netapp ontap tools 10
Related
Weakness · CWE (1)
- CWE-295 Improper Certificate Validation weakness
References
- https://github.com/apache/httpcomponents-client/pull/574 Issue Tracking, Patch
- https://github.com/apache/httpcomponents-client/pull/621 Issue Tracking, Patch
- https://hc.apache.org/httpcomponents-client-5.4.x/index.html Product
- https://lists.apache.org/thread/55xhs40ncqv97qvoocok44995xp5kqn8 Mailing List, Patch
- https://security.netapp.com/advisory/ntap-20250516-0003/ Third Party Advisory