CVE-2025-27820

A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification. Discovered by the Apache HttpClient team. Fixed in the 5.4.3 release

References

Affected packages

Git / github.com/apache/httpcomponents-client

Affected ranges

Type

GIT

Repo

https://github.com/apache/httpcomponents-client

Events

Introduced

84cccfe6300bca6b37abd05af527df08a781b677

Fixed

48236f5f1a7b78f4446d2c00c4c25c598148f57b

Database specific

{
    "versions": [
        {
            "introduced": "5.4"
        },
        {
            "fixed": "5.4.3"
        }
    ]
}

Database specific

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "10"
            }
        ]
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-27820.json"