CVE-2026-40542
Apache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to accept authentication without proper mutual authentication verification
Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Apache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to accept authentication without proper mutual authentication verification
Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.
- Record
CVE-2026-40542- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-304, CWE-325
- Updated
- 2026-11-02
EUVDEUVD-2026-24630
Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.
- Record
EUVD-2026-24630- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-v468-qcjx-r72w
Apache HttpClient accepts SCRAM-SHA-256 authentication without proper mutual authentication verification
Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.
- Record
GHSA-v468-qcjx-r72w- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-304
- Updated
- 2026-11-02
NVD
Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.
- Record
CVE-2026-40542- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-304, CWE-325
- Updated
- 2026-11-02
OSV
Apache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to accept authentication without proper mutual authentication verification
Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.
- Record
CVE-2026-40542- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-304
- Updated
- 2026-11-02
OSVGHSA-v468-qcjx-r72w
Apache HttpClient accepts SCRAM-SHA-256 authentication without proper mutual authentication verification
Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.
- Record
GHSA-v468-qcjx-r72w- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-304
- Updated
- 2026-11-02
OSVRHLW-2026-2a7b95611000d6b5
Lightwell Security Advisory: httpclient5 5.6.0.rhlw-00001
Red Hat Lightwell has released org.apache.httpcomponents.client5:httpclient5 5.6.0.rhlw-00001 with backported fixes for CVE-2026-40542 and CVE-2026-64607.
CVE-2026-40542: Apache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to accept authentication without proper mutual authentication verification
CVE-2026-64607: Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS
This patched artifact is a drop-in replacement for org.apache.httpcomponents.client5:httpclient5 5.6.0 from Maven Central.
- Record
RHLW-2026-2a7b95611000d6b5- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-40542
Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.
- Record
UBUNTU-CVE-2026-40542- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVROOT-APP-MAVEN-CVE-2026-40542 No score
CVE-2026-40542 in org.apache.httpcomponents.client5:httpclient5 - Patched by Root
Root has patched CVE-2026-40542 in the org.apache.httpcomponents.client5:httpclient5 package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2026-40542- Updated
- 2026-11-02
Affected products
- apache httpclient
- apache software foundation httpclient
- red hat cryostat 4
- red hat migration toolkit for applications 8
- red hat openshift developer tools and services
- red hat openshift developer tools and services 4.12
- red hat openshift developer tools and services 4.13
- red hat openshift developer tools and services 4.14
- red hat openshift developer tools and services 4.15
- red hat openshift developer tools and services 4.16
- red hat openshift developer tools and services 4.17
- red hat openshift developer tools and services 4.18
Show 37 moreShow less
- red hat openshift developer tools and services 4.19
- red hat openshift developer tools and services 4.20
- red hat openshift developer tools and services 4.21
- red hat openshift developer tools and services 4.22
- red hat openshift serverless
- red hat amq broker 7
- red hat amq clients
- red hat build of apache camel - hawtio 4
- red hat build of apache camel 4 for quarkus 3
- red hat build of apache camel for spring boot 4
- red hat build of apicurio registry 2
- red hat build of apicurio registry 3
- red hat build of debezium 3
- red hat build of optaplanner 8
- red hat build of quarkus
- red hat certificate system 10
- red hat data grid 8
- red hat enterprise linux 10
- red hat enterprise linux 7
- red hat enterprise linux 8
- red hat enterprise linux 9
- red hat fuse 7
- red hat jboss core services
- red hat jboss enterprise application platform 7
- red hat jboss enterprise application platform 8
- red hat jboss enterprise application platform expansion pack
- red hat jboss web server 5
- red hat jboss web server 6
- red hat lightspeed for runtimes operator
- red hat offline knowledge portal
- red hat openshift ai (rhoai)
- red hat openshift dev spaces
- red hat process automation 7
- red hat satellite 6
- red hat single sign-on 7
- red hat streams for apache kafka 2
- red hat streams for apache kafka 3
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.httpcomponents.client5:httpclient5Maven |
5.6-alpha1 up to 5.6.1 | 5.6.1 |
org.apache.httpcomponents.client5:httpclient5Maven |
5.6-alpha1 up to 5.6.1, plus listed versions 5.6 |
5.6.1 |
org.apache.httpcomponents.client5:httpclient5Red Hat Lightwell:Maven From an advisory covering 2 CVEs |
before 5.6.0.rhlw-00001, plus listed versions 5.05.0-alpha15.0-alpha25.0-alpha35.0-beta1 Show 40 moreShow less5.0-beta25.0-beta35.0-beta45.0-beta55.0-beta65.0-beta75.0.15.0.25.0.35.0.45.15.1-beta15.1.15.1.25.1.35.1.45.25.2-alpha15.2-beta15.2.15.2.25.2.35.35.3-alpha15.3.15.45.4-alpha15.4-alpha25.4-beta15.4.15.4.25.4.35.4.45.55.5-alpha15.5.15.5.25.65.6-alpha15.6.0 |
5.6.0.rhlw-00001 |
org.apache.httpcomponents.client5:httpclient5Root:Maven |
before 5.6.1-aikido.1 | 5.6.1-aikido.1 |
io.root.org.apache.httpcomponents.client5:httpclient5Root:Maven |
before 5.6.1-root.io.1 | 5.6.1-root.io.1 |
httpcomponents-clientUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 4.2.5-24.3.2-14.3.3-14.3.3-1ubuntu0.14.3.3-1ubuntu0.1+esm14.3.3-1ubuntu0.1+esm2 |
None known |
httpcomponents-clientUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 4.4.1-14.5.1-14.5.1-1ubuntu0.1~esm1 |
None known |
httpcomponents-clientUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 4.5.3-14.5.4-14.5.5-14.5.5-1ubuntu0.1~esm1 |
None known |
httpcomponents-clientUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 4.5.9-14.5.10-24.5.11-14.5.11-1ubuntu0.1~esm1 |
None known |
httpcomponents-clientUbuntu:22.04:LTS |
All versions, plus listed versions 4.5.13-24.5.13-3 |
None known |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
httpcomponents-clientUbuntu:24.04:LTS |
All versions, plus listed versions 4.5.14-1 |
None known |
httpcomponents-clientUbuntu:25.10 |
All versions, plus listed versions 4.5.14-1 |
None known |
httpcomponents-clientUbuntu:26.10 |
All versions, plus listed versions 4.5.14-1build1 |
None known |
httpcomponents-clientUbuntu:26.04:LTS |
All versions, plus listed versions 4.5.14-14.5.14-1build1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-40542 is a high vulnerability (CVSS 7.3) in Apache Httpclient, published April 22, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.54%, the 45th percentile. Fixed in org.apache.httpcomponents.client5:httpclient5 5.6.1.
References
lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97
openwall.com/lists/oss-security/2026/04/22/5
access.redhat.com/security/cve/CVE-2026-40542
bugzilla.redhat.com/show_bug.cgi?id=2460518
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40542.json
Show 22 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-40542
github.com/apache/httpcomponents-client/commit/726eac2323d370435d8afca1e0540aa099927f18
repo.maven.apache.org/maven2
ubuntu.com/security/CVE-2026-40542
cve.org/CVERecord?id=CVE-2026-40542