CVE-2025-27820: Apache Httpclient

High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days.

A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification. Discovered by the Apache HttpClient team. Fixed in the 5.4.3 release

Affected products

• Apache Httpclient: from 5.4, before 5.4.3 (fixed in 5.4.3)
• Netapp Ontap Tools: version 10 only

Published 2025-04-24. Last modified 2026-06-17.