CVE-2025-27820: Apache HttpComponents: PSL (Public Suffix List) validation bypass

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-04-24 · updated 2026-06-17
Weakness: CWE-295

Description

A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification. Discovered by the Apache HttpClient team. Fixed in the 5.4.3 release

Affected products

Apache Software Foundation Apache HttpClient: from 5.4 before 5.4.3 — fixed in 5.4.3
NetApp Ontap Tools: 10

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache HttpClient 5.4.3. Check the vendor advisory for mitigations.

References

https://github.com/apache/httpcomponents-client/pull/574
https://github.com/apache/httpcomponents-client/pull/621
https://hc.apache.org/httpcomponents-client-5.4.x/index.html
https://lists.apache.org/thread/55xhs40ncqv97qvoocok44995xp5kqn8
https://security.netapp.com/advisory/ntap-20250516-0003/

Get alerted when CVE-2025-27820 or the next vulnerability affects your stack