VULNERABILITY INTELLIGENCE

CVE-2025-27820

CVSS score7.5 HIGH
EPSS probability0.97%
CISA KEVNot currently listed
Published2025-04-24
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Description

A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification. Discovered by the Apache HttpClient team. Fixed in the 5.4.3 release

Weakness classification

  • 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-295

Primary references