CVE Feed

    Dashboard / CVE / CVE-2025-27820

    CVE-2025-27820

    A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification. Discovered by the Apache HttpClient team. Fixed in the 5.4.3 release

    Published:Apr 24, 2025
    Last Modified:Jul 16, 2025
    EPS:Apr 24, 2025
    EPSS Score:0.00043
    CVSS Score:7.5

    Affected Products

    Vendor
    Apache
    Product
    Httpclient
    Vendor
    Netapp
    Product
    Ontap Tools

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-295 Improper Certificate Validation

    Related CVEs

    CVE-2026-71290 (CVSS 9.1) — Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerific…
    CVE-2026-64607 (CVSS 5.3) — HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the con…
    CVE-2026-40542 (CVSS 7.3) — Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to acc…
    CVE-2020-13956 (CVSS 5.3) — Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in…
    CVE-2013-4366 (CVSS 9.8) — http/impl/client/HttpClientBuilder.java in Apache HttpClient 4.3.x before 4.3.1 does not ensure that X509Hostn…
    CVE-2015-5262 (CVSS 4.3) — http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the htt…
    CVE-2014-3577 (CVSS 5.8) — org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient…
    CVE-2012-5783 (CVSS 5.8) — Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other p…
    CVE-2011-1498 (CVSS 4.3) — Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used with an authenticating proxy server, se…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High