VulnerabilityAnalyzed

CVE-2025-27820

A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification.

HIGH 7.5EPSS 0.89%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.89%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification. Discovered by the Apache HttpClient team. Fixed in the 5.4.3 release

CVSS 3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS: 0.89% probability · 57th percentile
CISA KEV: Not listed
Weakness: CWE-295
Affected: apache/httpclient · netapp/ontap tools
Source: security@apache.org

References

https://github.com/apache/httpcomponents-client/pull/574Issue Tracking, Patch
https://github.com/apache/httpcomponents-client/pull/621Issue Tracking, Patch
https://hc.apache.org/httpcomponents-client-5.4.x/index.htmlProduct
https://lists.apache.org/thread/55xhs40ncqv97qvoocok44995xp5kqn8Mailing List, Patch
https://security.netapp.com/advisory/ntap-20250516-0003/Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.