7.5Alta
CVE-2025-27820Apache HttpComponents: PSL (Public Suffix List) validation bypass
Descripción
A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification. Discovered by the Apache HttpClient team. Fixed in the 5.4.3 release
Debilidad (CWE):
CWE-295
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| Apache Software Foundation | Apache HttpComponents | 5.4.0 – < 5.4.3 | |
| apache | httpclient | 5.4 – < 5.4.3 | |
| netapp | ontap tools | 10 |
Referencias y parches
- https://github.com/apache/httpcomponents-client/pull/574 patchIssue TrackingPatch
- https://github.com/apache/httpcomponents-client/pull/621 patchIssue TrackingPatch
- https://hc.apache.org/httpcomponents-client-5.4.x/index.html productProduct
- https://lists.apache.org/thread/55xhs40ncqv97qvoocok44995xp5kqn8 vendor-advisoryMailing ListPatch
- https://security.netapp.com/advisory/ntap-20250516-0003/ Third Party Advisory
Coincidencias CPE (NVD) (2)
cpe:2.3:a:apache:httpclient:*:*:*:*:*:*:*:*≥ 5.4 < 5.4.3cpe:2.3:a:netapp:ontap_tools:10:*:*:*:*:vmware_vsphere:*:*