Description
A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification. Discovered by the Apache HttpClient team. Fixed in the 5.4.3 release
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Apache Software Foundation Apache HttpComponents
Default version status: unaffected
5.4.0 to < 5.4.3affected
References
- https://github.com/apache/httpcomponents-client/pull/574 ↗
- https://github.com/apache/httpcomponents-client/pull/621 ↗
- https://hc.apache.org/httpcomponents-client-5.4.x/index.html ↗
- https://lists.apache.org/thread/55xhs40ncqv97qvoocok44995xp5kqn8 ↗
- https://security.netapp.com/advisory/ntap-20250516-0003/ ↗