CVE-2025-27820

🗓️ 24 Apr 2025 11:44:25Reported by apacheType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 315 Views

CVE-2025-27820 affects Apache HttpClient 5.4.x, disabling domain checks in cookie management.

Reporter	Title	Published	Views	Family All 42
IBM Security Bulletins	Security Bulletin: A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, which affects IBM watsonx.data	1 Sep 202514:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an Improper Access Control vulnerability in Apache HttpClient [CVE-2025-27820]	28 Aug 202517:04	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite Ai-Service Component uses A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification. Discovered by the Apache HttpClient team.	9 May 202509:06	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in httpclient5-5.4.2.jar	11 Jul 202511:33	–	ibm
Atlassian	Third-Party Dependency in Bamboo Data Center and Server	8 Jul 202505:09	–	atlassian
Atlassian	MITM (Man-in-the-Middle) org.apache.httpcomponents.client5:httpclient5 Dependency in Confluence Data Center and Server	2 Jul 202504:09	–	atlassian
Atlassian	MITM (Man-in-the-Middle) org.apache.httpcomponents.client5:httpclient5 Dependency in Jira Software Data Center and Server	5 Jul 202505:09	–	atlassian
BDU FSTEC	The vulnerability of the PSL validation mechanism in the Apache HttpClient client module of Apache HttpComponents allows a attacker to perform a CSRF attack.	28 Apr 202500:00	–	bdu_fstec
Chainguard	CVE-2025-27820 vulnerabilities	26 Apr 202501:14	–	cgr
Circl	CVE-2025-27820	24 Apr 202512:06	–	circl

NVD

Vulners

Node

apache httpclientRange5.4–5.4.3

Node

netapp ontap_toolsMatch10vmware_vsphere

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache HttpComponents",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "5.4.3",
        "status": "affected",
        "version": "5.4.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
github	www.github.com/apache/httpcomponents-client/pull/621
lists	www.lists.apache.org/thread/55xhs40ncqv97qvoocok44995xp5kqn8
github	www.github.com/apache/httpcomponents-client/pull/574
hc	www.hc.apache.org/httpcomponents-client-5.4.x/index.html
security	www.security.netapp.com/advisory/ntap-20250516-0003/

16 Jul 2025 14:48Current

6.9Medium risk

Vulners AI Score6.9

CVSS 3.17.5

EPSS0.00071

SSVC

CWE-295

cve-2025-27820 apache httpclient bug domain checks cookie management host name verification