High
httpcomponents-client — security advisory
A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification. Discovered by the Apache HttpClient team. Fixed in the 5.4.3 release
- Products
- httpcomponents-client
- Affected versions
- 4.2.5-2, 4.3.2-1, 4.3.3-1, 4.3.3-1ubuntu0.1, 4.3.3-1ubuntu0.1+esm1, 4.3.3-1ubuntu0.1+esm2, 4.4.1-1, 4.5.1-1, 4.5.1-1ubuntu0.1~esm1, 4.5.10-2, 4.5.11-1, 4.5.11-1ubuntu0.1~esm1, 4.5.13-2, 4.5.13-3, 4.5.14-1, 4.5.14-1build1, 4.5.3-1, 4.5.4-1, 4.5.5-1, 4.5.5-1ubuntu0.1~esm1, 4.5.9-1
- Fixed versions
- Not specified
- CVEs
- CVE-2025-27820
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 01:26 UTC · Revision 1
Source evidence
A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification. Discovered by the Apache HttpClient team. Fixed in the 5.4.3 release
osv:UBUNTU-CVE-2025-27820
httpcomponents-client
Fixed versions: Not specified
httpcomponents-client
Fixed versions: Not specified
httpcomponents-client
Fixed versions: Not specified
httpcomponents-client
Fixed versions: Not specified
httpcomponents-client
Fixed versions: Not specified
httpcomponents-client
Fixed versions: Not specified
httpcomponents-client
Fixed versions: Not specified
httpcomponents-client
Fixed versions: Not specified
httpcomponents-client
Fixed versions: Not specified
Complete source record
{
"id": "ec61e9dc86acd8ca90f128d68403635e5223ac19eab4b8a1d2bbdc26119cd87f",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2025-27820",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2025-27820",
"summary": "A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification. Discovered by the Apache HttpClient team. Fixed in the 5.4.3 release",
"evidence": "osv:UBUNTU-CVE-2025-27820",
"products": [
{
"name": {
"value": "httpcomponents-client",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "4.2.5-2",
"evidence": "/affected/0/versions"
},
{
"value": "4.3.2-1",
"evidence": "/affected/0/versions"
},
{
"value": "4.3.3-1",
"evidence": "/affected/0/versions"
},
{
"value": "4.3.3-1ubuntu0.1",
"evidence": "/affected/0/versions"
},
{
"value": "4.3.3-1ubuntu0.1+esm1",
"evidence": "/affected/0/versions"
},
{
"value": "4.3.3-1ubuntu0.1+esm2",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "httpcomponents-client",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "4.4.1-1",
"evidence": "/affected/1/versions"
},
{
"value": "4.5.1-1",
"evidence": "/affected/1/versions"
},
{
"value": "4.5.1-1ubuntu0.1~esm1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "httpcomponents-client",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "4.5.3-1",
"evidence": "/affected/2/versions"
},
{
"value": "4.5.4-1",
"evidence": "/affected/2/versions"
},
{
"value": "4.5.5-1",
"evidence": "/affected/2/versions"
},
{
"value": "4.5.5-1ubuntu0.1~esm1",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "httpcomponents-client",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "4.5.9-1",
"evidence": "/affected/3/versions"
},
{
"value": "4.5.10-2",
"evidence": "/affected/3/versions"
},
{
"value": "4.5.11-1",
"evidence": "/affected/3/versions"
},
{
"value": "4.5.11-1ubuntu0.1~esm1",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "httpcomponents-client",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "4.5.13-2",
"evidence": "/affected/4/versions"
},
{
"value": "4.5.13-3",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "httpcomponents-client",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "4.5.14-1",
"evidence": "/affected/5/versions"
}
]
},
{
"name": {
"value": "httpcomponents-client",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "4.5.14-1",
"evidence": "/affected/6/versions"
}
]
},
{
"name": {
"value": "httpcomponents-client",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "4.5.14-1build1",
"evidence": "/affected/7/versions"
}
]
},
{
"name": {
"value": "httpcomponents-client",
"evidence": "/affected/8/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "4.5.14-1",
"evidence": "/affected/8/versions"
},
{
"value": "4.5.14-1build1",
"evidence": "/affected/8/versions"
}
]
}
],
"severity": "high",
"structured": {
"id": "UBUNTU-CVE-2025-27820",
"aliases": [
"UBUNTU-CVE-2025-27820"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "httpcomponents-client",
"purl": "pkg:deb/ubuntu/httpcomponents-client?arch=source&distro=esm-infra-legacy%2Ftrusty",
"ecosystem": "Ubuntu:Pro:14.04:LTS"
},
"versions": [
"4.2.5-2",
"4.3.2-1",
"4.3.3-1",
"4.3.3-1ubuntu0.1",
"4.3.3-1ubuntu0.1+esm1",
"4.3.3-1ubuntu0.1+esm2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-27820.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libhttpclient-java",
"binary_version": "4.3.3-1ubuntu0.1+esm2"
},
{
"binary_name": "libhttpmime-java",
"binary_version": "4.3.3-1ubuntu0.1+esm2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "httpcomponents-client",
"purl": "pkg:deb/ubuntu/httpcomponents-client?arch=source&distro=esm-apps%2Fxenial",
"ecosystem": "Ubuntu:Pro:16.04:LTS"
},
"versions": [
"4.4.1-1",
"4.5.1-1",
"4.5.1-1ubuntu0.1~esm1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-27820.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libhttpclient-java",
"binary_version": "4.5.1-1ubuntu0.1~esm1"
},
{
"binary_name": "libhttpmime-java",
"binary_version": "4.5.1-1ubuntu0.1~esm1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "httpcomponents-client",
"purl": "pkg:deb/ubuntu/httpcomponents-client?arch=source&distro=esm-apps%2Fbionic",
"ecosystem": "Ubuntu:Pro:18.04:LTS"
},
"versions": [
"4.5.3-1",
"4.5.4-1",
"4.5.5-1",
"4.5.5-1ubuntu0.1~esm1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-27820.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libhttpclient-java",
"binary_version": "4.5.5-1ubuntu0.1~esm1"
},
{
"binary_name": "libhttpmime-java",
"binary_version": "4.5.5-1ubuntu0.1~esm1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "httpcomponents-client",
"purl": "pkg:deb/ubuntu/httpcomponents-client?arch=source&distro=esm-apps%2Ffocal",
"ecosystem": "Ubuntu:Pro:20.04:LTS"
},
"versions": [
"4.5.9-1",
"4.5.10-2",
"4.5.11-1",
"4.5.11-1ubuntu0.1~esm1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-27820.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libhttpclient-java",
"binary_version": "4.5.11-1ubuntu0.1~esm1"
},
{
"binary_name": "libhttpmime-java",
"binary_version": "4.5.11-1ubuntu0.1~esm1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "httpcomponents-client",
"purl": "pkg:deb/ubuntu/httpcomponents-client?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"4.5.13-2",
"4.5.13-3"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-27820.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libhttpclient-java",
"binary_version": "4.5.13-3"
},
{
"binary_name": "libhttpmime-java",
"binary_version": "4.5.13-3"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "httpcomponents-client",
"purl": "pkg:deb/ubuntu/httpcomponents-client?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"4.5.14-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-27820.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libhttpclient-java",
"binary_version": "4.5.14-1"
},
{
"binary_name": "libhttpmime-java",
"binary_version": "4.5.14-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "httpcomponents-client",
"purl": "pkg:deb/ubuntu/httpcomponents-client?arch=source&distro=questing",
"ecosystem": "Ubuntu:25.10"
},
"versions": [
"4.5.14-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-27820.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libhttpclient-java",
"binary_version": "4.5.14-1"
},
{
"binary_name": "libhttpmime-java",
"binary_version": "4.5.14-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "httpcomponents-client",
"purl": "pkg:deb/ubuntu/httpcomponents-client?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"4.5.14-1build1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-27820.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libhttpclient-java",
"binary_version": "4.5.14-1build1"
},
{
"binary_name": "libhttpmime-java",
"binary_version": "4.5.14-1build1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "httpcomponents-client",
"purl": "pkg:deb/ubuntu/httpcomponents-client?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"4.5.14-1",
"4.5.14-1build1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-27820.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libhttpclient-java",
"binary_version": "4.5.14-1build1"
},
{
"binary_name": "libhttpmime-java",
"binary_version": "4.5.14-1build1"
}
]
}
}
],
"modified": "2026-10-17T12:56:49.971928773Z",
"provider": "osv",
"upstream": [
"CVE-2025-27820"
],
"references": [
"https://ubuntu.com/security/CVE-2025-27820",
"https://www.cve.org/CVERecord?id=CVE-2025-27820",
"https://lists.apache.org/thread/55xhs40ncqv97qvoocok44995xp5kqn8",
"https://github.com/apache/httpcomponents-client/pull/574",
"https://github.com/apache/httpcomponents-client/pull/621",
"https://hc.apache.org/httpcomponents-client-5.4.x/index.html"
]
},
"related_cves": [
{
"value": "CVE-2025-27820",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 356419,
"published_at": "2025-04-24T12:15:00+00:00"
}