GitHub Advisoryadvisory · Maven

GHSA-73m2-qfq3-56cx Apache HttpClient disables domain checks

HIGH Published 2025-04-24 Modified 2025-05-17 Official page ↗
Aliases
CVE-2025-27820
Ecosystem
Maven
Packages
org.apache.httpcomponents.client5:httpclient5
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-295
Reviewed
2025-04-24

Affected packages

• Maven org.apache.httpcomponents.client5:httpclient5: >= 5.4-alpha1, < 5.4.3 → fixed in 5.4.3

Description

A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification. Discovered by the Apache HttpClient team. Fixed in the 5.4.3 release.

Related

Alias · CVE (1)

  • CVE-2025-27820 A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification. vulnerability

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References