CVE-2025-27820
Apache HttpComponents: PSL (Public Suffix List) validation bypass
Summary
Apache HttpComponents: PSL (Public Suffix List) validation bypass
Original description
The description as published by the source.
A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification. Discovered by the Apache HttpClient team. Fixed in the 5.4.3 release
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Ubuntu UBUNTU-CVE-2025-27820 httpcomponents-client
References
- advisory github.com
- advisory lists.apache.org
- advisory nvd.nist.gov
- advisory security.netapp.com
- patch github.com
- patch github.com
- web hc.apache.org