CVE-2025-27820 Apache HttpComponents: PSL (Public Suffix List) validation bypass

What is CVE-2025-27820?

CVE-2025-27820 is a high-severity vulnerability in Apache HttpComponents, published on 24 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification. Discovered by the Apache HttpClient team. Fixed in the 5.4.3 release

Weakness: CWE-295

Which versions are affected by CVE-2025-27820?

2 open source packages ship an affected version, including org.apache.httpcomponents.client5:httpclient5. It affects 2 products.

Products include Apache Httpclient, Netapp Ontap Tools.

How do I fix CVE-2025-27820?

Upgrade org.apache.httpcomponents.client5:httpclient5 to 5.4.3 or later.

Is CVE-2025-27820 being exploited?

There is no known exploitation of CVE-2025-27820 in the wild and no public exploit code.

Other vulnerabilities in Apache HttpComponents

• CVE-2013-4366 Hostname verification in Apache HttpClient 4.3 was disabled by default Critical 9.8
• CVE-2026-71290 Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM) Critical 9.1
• CVE-2026-40542 Apache HttpClient accepts SCRAM-SHA-256 authentication without proper mutual authentication verification High 7.3
• CVE-2012-5783 Improper Certificate Validation in Apache Commons HttpClient Medium 5.8
• CVE-2026-64607 Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-73m2-qfq3-56cx, MINI-8pc5-2xv5-mjxm, UBUNTU-CVE-2025-27820.