Configuration in Apache Commons HttpClient - CVE-2025-27820

Vulnerability identifier: #VU109240

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-27820

CWE-ID: CWE-16

Exploitation vector: Remote access

Exploit availability: No public exploit available

The issue may allow a remote attacker to bypass security restrictions.

The issue exists due to an error in PSL validation logic that disables domain checks, affecting cookie management and host name verification. A remote attacker can gain unauthorized access to sensitive information.

Apache Commons HttpClient
IBM Cloud Pak for Watson AIOps
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
Oracle Financial Services Analytical Applications Infrastructure
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Observability with Instana
Jira Service Management Server
Jira Service Management Data Center
Confluence Data Center
Jira Software Data Center
Bamboo Server
watsonx.data
Oracle Financial Services Regulatory Reporting
Confluence Server
Jira Software Server
Oracle GoldenGate Big Data and Application Adapters

Install updates from vendor's website.

Apache Commons HttpClient - update to 5.4.3
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.2.1
IBM Observability with Instana - update to 1.0.297
watsonx.data - update to 2.2.1
IBM Cloud Pak for Watson AIOps - update to 4.10.0
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.2
Jira Service Management Server - addressed in versions 5.12.24, 10.3.8, 10.7.2
Jira Service Management Data Center - addressed in versions 5.12.24, 10.3.8, 10.7.2
Confluence Server - addressed in versions 9.2.6, 9.5.2
Confluence Data Center - addressed in versions 9.2.6, 9.5.2
Jira Software Server - addressed in versions 9.12.24, 10.3.8, 10.7.2
Jira Software Data Center - addressed in versions 9.12.24, 10.3.8, 10.7.2
Bamboo Server - addressed in versions 10.2.6, 11.0.3

• https://github.com/apache/httpcomponents-client/pull/574
• https://github.com/apache/httpcomponents-client/pull/621
• https://hc.apache.org/httpcomponents-client-5.4.x/index.html
• https://lists.apache.org/thread/55xhs40ncqv97qvoocok44995xp5kqn8

• Information disclosure in Apache HttpClient
• Multiple vulnerabilities in IBM Observability with Instana (OnPrem)
• Multiple vulnerabilities in IBM Cloud Pak for AIOps
• IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data update for Apache HttpClient
• Multiple vulnerabilities in Oracle GoldenGate Big Data and Application Adapters
• Jira Software Data Center and Server update for httpclient5
• Bamboo Data Center and Server update for Apache Commons HttpClient
• Confluence Data Center and Server update for httpclient5
• Jira Service Management Data Center and Server update for httpclient5
• IBM Watson Speech Services Cartridge update for Apache HttpClient
• IBM watsonx.data update for Apache HttpClient
• Configuration in Oracle Financial Services Regulatory Reporting
• Multiple vulnerabilities in Oracle Financial Services Analytical Applications Infrastructure