7.5Hoch
CVE-2025-27820Apache HttpComponents: PSL (Public Suffix List) validation bypass
Beschreibung
A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification. Discovered by the Apache HttpClient team. Fixed in the 5.4.3 release
Schwachstellentyp (CWE):
CWE-295
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| Apache Software Foundation | Apache HttpComponents | 5.4.0 – < 5.4.3 | |
| apache | httpclient | 5.4 – < 5.4.3 | |
| netapp | ontap tools | 10 |
Referenzen und Patches
- https://github.com/apache/httpcomponents-client/pull/574 patchIssue TrackingPatch
- https://github.com/apache/httpcomponents-client/pull/621 patchIssue TrackingPatch
- https://hc.apache.org/httpcomponents-client-5.4.x/index.html productProduct
- https://lists.apache.org/thread/55xhs40ncqv97qvoocok44995xp5kqn8 vendor-advisoryMailing ListPatch
- https://security.netapp.com/advisory/ntap-20250516-0003/ Third Party Advisory
CPE-Treffer (NVD) (2)
cpe:2.3:a:apache:httpclient:*:*:*:*:*:*:*:*≥ 5.4 < 5.4.3cpe:2.3:a:netapp:ontap_tools:10:*:*:*:*:vmware_vsphere:*:*