HIGH7.5

GHSA-73m2-qfq3-56cx

Apache HttpClient disables domain checks

Quick fix

GHSA-73m2-qfq3-56cx — org.apache.httpcomponents.client5:httpclient5: upgrade to the fixed version with the command below.

# pom.xml: bump <version>5.4.3</version> for org.apache.httpcomponents.client5:httpclient5

Details

A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification. Discovered by the Apache HttpClient team. Fixed in the 5.4.3 release.

Are you affected?

Enter the version of the package you're using.

Affected packages

Maven/org.apache.httpcomponents.client5:httpclient5

Introduced in: 5.4-alpha1Fixed in: 5.4.3

Fix# pom.xml: bump <version>5.4.3</version> for org.apache.httpcomponents.client5:httpclient5

References

https://nvd.nist.gov/vuln/detail/CVE-2025-27820[ADVISORY]
https://github.com/apache/httpcomponents-client/pull/574[WEB]
https://github.com/apache/httpcomponents-client/pull/621[WEB]
https://github.com/apache/httpcomponents-client[PACKAGE]
https://hc.apache.org/httpcomponents-client-5.4.x/index.html[WEB]
https://lists.apache.org/thread/55xhs40ncqv97qvoocok44995xp5kqn8[WEB]
https://security.netapp.com/advisory/ntap-20250516-0003[WEB]