Skip to content

Please update internal Apache HTTP client5 version because of CVE-2025-27820 #557

Open
@peterschulerrabo

Description

@peterschulerrabo

The current version used by Apache HTTP client5 contains a severe vulnerability. See https://nvd.nist.gov/vuln/detail/CVE-2025-27820. As the current release of java-client includes this version it should be upgrade to at least 5.4.3.

Can this be done so the vulnerability is fixed. This also helps with our internal CLM software as this will flag our software which includes java-client as vulnerable and blocks our releases. And as the java-client comes with an internal version of Apache HTTP client5 we can overwrite this version ourself.

A colleague of mine already created a pull request: #556

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions