CVE-2025-27820

Apache HttpComponents: PSL (Public Suffix List) validation bypass

High · published April 24, 2025

CVSS v3.1
7.5
EPSS
1%
Percentile
60.9
In the wild
Unconfirmed
What it is

A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification. Discovered by the Apache HttpClient team. Fixed in the 5.4.3 release

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00950 · 60.9th percentile
Published
2025-04-24T11:44Z
EPSS history
Timeline
  • 24 APR 11:44Z
    Apache HttpComponents: PSL (Public Suffix List) validation bypass
    cvelistv5