Bug 2362042 (CVE-2025-27820)

Summary: CVE-2025-27820 org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents: PSL (Public Suffix List) validation bypass
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aazores, abrianik, asoldano, ataylor, bbaranow, bmaxwell, brian.stansberry, caswilli, ccranfor, cdewolf, chfoley, cmah, csutherl, darran.lofthouse, dhanak, dkreling, dosoudil, eaguilar, ebaron, eric.wittmann, fjuma, fmariani, fmongiar, ggrzybek, gmalinko, ibek, istudens, ivassile, iweiss, janstey, jclere, jkoehler, jnethert, jolong, jpechane, jpoth, jrokos, kaycoth, kholdawa, kverlaen, lcouzens, lgao, lphiri, mnovotny, mosmerov, mskarbek, msochure, msvehla, nipatil, nwallace, pantinor, parichar, pdelbell, pesilva, pjindal, plodge, pmackay, porcelli, rguimara, rkieley, rkubis, rstancel, rstepani, sfroberg, smaestri, swoodman, szappis, tasato, tcunning, tom.jenkinson, yfang
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Apache HttpClient. This vulnerability allows unauthorized access or information disclosure via disabled Public Suffix List (PSL) validation, affecting cookie management and hostname verification.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-04-24 12:01:10 UTC
A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification. Discovered by the Apache HttpClient team. Fixed in the 5.4.3 release