CVE-2025-27820

Apache HttpComponents: PSL (Public Suffix List) validation bypass

CVSS 7.5 HIGHEPSS 0.7%CWE-295

A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification. Discovered by the Apache HttpClient team. Fixed in the 5.4.3 release

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Productos afectados

Apache Software Foundation · Apache HttpComponents

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →

Referencias

https://github.com/apache/httpcomponents-client/pull/574 https://github.com/apache/httpcomponents-client/pull/621 https://hc.apache.org/httpcomponents-client-5.4.x/index.html https://lists.apache.org/thread/55xhs40ncqv97qvoocok44995xp5kqn8 https://security.netapp.com/advisory/ntap-20250516-0003/