CVE-2025-27820

—

CVSS 3.1

7.5 high

EPSS

<1%p57

Published

Apr 24, 2025 (Apr 24, 2025)

Modified

Jun 17, 2026

Description

A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification. Discovered by the Apache HttpClient team. Fixed in the 5.4.3 release

Vendors: apache netapp
Products: httpclient, ontap tools
Weakness: CWE-295
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (0.9%)

In the news0 stories

No ingested article mentions this CVE yet.