CVE-2025-27820: Apache HttpClient 5.4.x Domain Check Disabling Vulnerability
Summary
CVE-2025-27820: Apache HttpClient disables domain checks. Affects org.apache.httpcomponents.client5:httpclient5 versions >= 5.4-alpha1, < 5.4.3. Fixed in 5.4.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HttpClient is a widely used library in Java for making HTTP requests. It provides a robust set of features for cookie management, connection management, and host name verification. However, a bug in the Public Suffix List (PSL) validation logic in versions 5.4.x has led to the disabling of crucial domain checks, which can compromise the security of applications relying on this library.
Vulnerability Detail
The vulnerability arises from a flaw in the PSL validation logic within Apache HttpClient version 5.4.x. This flaw disables essential domain checks, which can lead to improper cookie management and host name verification. As a result, attackers could exploit this vulnerability to hijack sessions or perform man-in-the-middle attacks, potentially compromising sensitive user data.
How To Fix
Latest published version: 5.7-beta1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.4.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement additional validation checks in your application to ensure that domain checks are performed manually until the library is updated. However, this is not a substitute for applying the official patch.
Conclusion
The Apache HttpClient vulnerability CVE-2025-27820 poses significant risks due to the disabling of domain checks. It is crucial for developers using this library to update to version 5.4.3 or later to mitigate these risks. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for org.apache.httpcomponents.client5:httpclient5 →
FAQ
CVE-2025-27820 is a vulnerability in Apache HttpClient 5.4.x that disables domain checks due to a bug in the PSL validation logic.
The risks include potential session hijacking and man-in-the-middle attacks, which can lead to unauthorized access to sensitive information.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, implement additional manual domain validation checks as a temporary workaround.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.httpcomponents.client5:httpclient5.
