CVE-2025-27820

Apache HttpComponents: PSL (Public Suffix List) validation bypass

CVSS 7.5 HIGHEPSS 0.7%CWE-295

Vexday Risk Score

21Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 7.5EPSS 0.7%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Ciclo de vida

24 abr 2025Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification. Discovered by the Apache HttpClient team. Fixed in the 5.4.3 release

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Produtos afetados

Apache Software Foundation · Apache HttpComponents

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://github.com/apache/httpcomponents-client/pull/574 https://github.com/apache/httpcomponents-client/pull/621 https://hc.apache.org/httpcomponents-client-5.4.x/index.html https://lists.apache.org/thread/55xhs40ncqv97qvoocok44995xp5kqn8 https://security.netapp.com/advisory/ntap-20250516-0003/