CVE-2025-27820

EPSS 0.03%
Published 24.04.2025 11:44:25
Last modified 16.07.2025 14:48:52
Source security@apache.org
Teams watchlist Login
Open Login

A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification. Discovered by the Apache HttpClient team. Fixed in the 5.4.3 release

Affected products Warnungen 0 Metrics 2 CWE 1 References 8

Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD

This information is available to logged-in users.

Data is provided by the National Vulnerability Database (NVD)

Apache ≫ Httpclient Version >= 5.4 < 5.4.3

Netapp ≫ Ontap Tools Version10 SwPlatformvmware_vsphere

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.03%	0.062

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
134c704f-9b21-4f2e-91b3-4a467353bcc0	7.5	3.9	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE-295 Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

https://github.com/apache/httpcomponents-client/pull/574

Patch

Issue Tracking

https://github.com/apache/httpcomponents-client/pull/621

Patch

Issue Tracking

https://hc.apache.org/httpcomponents-client-5.4.x/index.html

Product

https://lists.apache.org/thread/55xhs40ncqv97qvoocok44995xp5kqn8

Patch

Mailing List

https://security.netapp.com/advisory/ntap-20250516-0003/

Third Party Advisory

https://nvd.nist.gov/vuln/detail/CVE-2025-27820

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2025-27820

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2025-27820

EUVD