Domain Validation Flaw in Apache HttpClient Impacts Cookie Management

CVE-2025-27820

What is CVE-2025-27820?

A flaw in the domain validation logic of Apache HttpClient 5.4.x compromises the integrity of cookie management and host name verification, allowing unauthorized access to sensitive data. This vulnerability disables critical domain checks, paving the way for potential exploits. The issue was identified by the Apache HttpClient team and addressed in version 5.4.3, which users are strongly recommended to upgrade to in order to mitigate risks.

References