{"id":"CVE-2026-40542","aliases":["EUVD-2026-24630","GHSA-hjcp-jmpx-g3qm","GHSA-v468-qcjx-r72w","RHLW-2026-2a7b95611000d6b5","ROOT-APP-MAVEN-CVE-2026-40542","UBUNTU-CVE-2026-40542"],"status":"published","title":"Apache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to accept authentication without proper mutual authentication verification","description":"Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00536,"percentile":0.4566,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-304","CWE-325"],"published":"2026-04-22T07:07:21Z","modified":"2026-10-28T02:30:52Z","fixes":[{"ecosystem":"Maven","package":"org.apache.httpcomponents.client5:httpclient5","fixed_in":["5.6.1"],"sources":["ghsa","osv"]},{"ecosystem":"Root:Maven","package":"org.apache.httpcomponents.client5:httpclient5","fixed_in":["5.6.1-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.apache.httpcomponents.client5:httpclient5","fixed_in":["5.6.1-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.httpcomponents.client5:httpclient5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6-alpha1"},{"fixed":"5.6.1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.httpcomponents.client5:httpclient5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6-alpha1"},{"fixed":"5.6.1"}]}],"versions":["5.6","5.6-alpha1"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.apache.httpcomponents.client5:httpclient5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.0.rhlw-00001"}]}],"versions":["5.0","5.0-alpha1","5.0-alpha2","5.0-alpha3","5.0-beta1","5.0-beta2","5.0-beta3","5.0-beta4","5.0-beta5","5.0-beta6","5.0-beta7","5.0.1","5.0.2","5.0.3","5.0.4","5.1","5.1-beta1","5.1.1","5.1.2","5.1.3","5.1.4","5.2","5.2-alpha1","5.2-beta1","5.2.1","5.2.2","5.2.3","5.3","5.3-alpha1","5.3.1","5.4","5.4-alpha1","5.4-alpha2","5.4-beta1","5.4.1","5.4.2","5.4.3","5.4.4","5.5","5.5-alpha1","5.5.1","5.5.2","5.6","5.6-alpha1","5.6.0"],"bundled":2},{"source":"osv","ecosystem":"Root:Maven","package":"org.apache.httpcomponents.client5:httpclient5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.1-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.apache.httpcomponents.client5:httpclient5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.1-root.io.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"httpcomponents-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.2.5-2","4.3.2-1","4.3.3-1","4.3.3-1ubuntu0.1","4.3.3-1ubuntu0.1+esm1","4.3.3-1ubuntu0.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"httpcomponents-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.1-1","4.5.1-1","4.5.1-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"httpcomponents-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.5.3-1","4.5.4-1","4.5.5-1","4.5.5-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"httpcomponents-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.5.9-1","4.5.10-2","4.5.11-1","4.5.11-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"httpcomponents-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.5.13-2","4.5.13-3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"httpcomponents-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.5.14-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"httpcomponents-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.5.14-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"httpcomponents-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.5.14-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"httpcomponents-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.5.14-1","4.5.14-1build1"]}],"products":[{"vendor":"apache","product":"httpclient"},{"vendor":"apache software foundation","product":"apache httpclient"},{"vendor":"red hat","product":"cryostat 4"},{"vendor":"red hat","product":"migration toolkit for applications 8"},{"vendor":"red hat","product":"openshift developer tools and services"},{"vendor":"red hat","product":"openshift developer tools and services 4.12"},{"vendor":"red hat","product":"openshift developer tools and services 4.13"},{"vendor":"red hat","product":"openshift developer tools and services 4.14"},{"vendor":"red hat","product":"openshift developer tools and services 4.15"},{"vendor":"red hat","product":"openshift developer tools and services 4.16"},{"vendor":"red hat","product":"openshift developer tools and services 4.17"},{"vendor":"red hat","product":"openshift developer tools and services 4.18"},{"vendor":"red hat","product":"openshift developer tools and services 4.19"},{"vendor":"red hat","product":"openshift developer tools and services 4.20"},{"vendor":"red hat","product":"openshift developer tools and services 4.21"},{"vendor":"red hat","product":"openshift developer tools and services 4.22"},{"vendor":"red hat","product":"openshift serverless"},{"vendor":"red hat","product":"red hat amq broker 7"},{"vendor":"red hat","product":"red hat amq clients"},{"vendor":"red hat","product":"red hat build of apache camel - hawtio 4"},{"vendor":"red hat","product":"red hat build of apache camel 4 for quarkus 3"},{"vendor":"red hat","product":"red hat build of apache camel for spring boot 4"},{"vendor":"red hat","product":"red hat build of apicurio registry 2"},{"vendor":"red hat","product":"red hat build of apicurio registry 3"},{"vendor":"red hat","product":"red hat build of debezium 3"},{"vendor":"red hat","product":"red hat build of optaplanner 8"},{"vendor":"red hat","product":"red hat build of quarkus"},{"vendor":"red hat","product":"red hat certificate system 10"},{"vendor":"red hat","product":"red hat data grid 8"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat fuse 7"},{"vendor":"red hat","product":"red hat jboss core services"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 7"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 8"},{"vendor":"red hat","product":"red hat jboss enterprise application platform expansion pack"},{"vendor":"red hat","product":"red hat jboss web server 5"},{"vendor":"red hat","product":"red hat jboss web server 6"},{"vendor":"red hat","product":"red hat lightspeed for runtimes operator"},{"vendor":"red hat","product":"red hat offline knowledge portal"},{"vendor":"red hat","product":"red hat openshift ai (rhoai)"},{"vendor":"red hat","product":"red hat openshift dev spaces"},{"vendor":"red hat","product":"red hat process automation 7"},{"vendor":"red hat","product":"red hat satellite 6"},{"vendor":"red hat","product":"red hat single sign-on 7"},{"vendor":"red hat","product":"streams for apache kafka 2"},{"vendor":"red hat","product":"streams for apache kafka 3"}],"references":[{"url":"https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97","tags":["vendor-advisory","Mailing List","Vendor Advisory","advisory","web","report"]},{"url":"http://www.openwall.com/lists/oss-security/2026/04/22/5","tags":["Mailing List","Third Party Advisory","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-40542","tags":["vdb-entry","x_refsource_REDHAT","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2460518","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40542.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60247","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60249","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60248","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60239","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60251","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60246","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60250","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60252","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60259","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60254","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60256","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40542","tags":["advisory"]},{"url":"https://github.com/apache/httpcomponents-client/commit/726eac2323d370435d8afca1e0540aa099927f18","tags":["web"]},{"url":"https://github.com/advisories/GHSA-v468-qcjx-r72w","tags":["advisory"]},{"url":"https://repo.maven.apache.org/maven2","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40542.json","tags":["advisory"]},{"url":"https://github.com/apache/httpcomponents-client","tags":["package"]},{"url":"https://repo.maven.apache.org/maven2/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64607.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64607","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-hjcp-jmpx-g3qm","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-40542","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-40542","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-40542","title":"Apache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to accept authentication without proper mutual authentication verification","description":"Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.","status":"published","published":"2026-04-22T07:07:21.344Z","modified":"2026-09-09T12:05:01.516Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"adp"},{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"adp"}],"cwes":["CWE-304","CWE-325"],"updated_at":"2026-11-02T13:43:11.445168Z"}],"euvd":[{"id":"EUVD-2026-24630","description":"Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.","status":"published","published":"2026-04-22T07:07:21Z","modified":"2026-09-09T12:05:01Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T17:28:27.763941Z"}],"ghsa":[{"id":"GHSA-v468-qcjx-r72w","title":"Apache HttpClient accepts SCRAM-SHA-256 authentication without proper mutual authentication verification","description":"Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.","status":"published","published":"2026-04-22T09:31:31Z","modified":"2026-04-29T20:52:55Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-304"],"updated_at":"2026-11-02T14:39:59.776263Z"}],"nvd":[{"id":"CVE-2026-40542","description":"Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.","status":"published","published":"2026-04-22T08:16:12.78Z","modified":"2026-10-26T21:10:00.17Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-304","CWE-325"],"updated_at":"2026-11-02T14:12:15.493943Z"}],"osv":[{"id":"CVE-2026-40542","title":"Apache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to accept authentication without proper mutual authentication verification","description":"Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.","status":"published","published":"2026-04-22T07:07:21.344Z","modified":"2026-10-28T02:30:52.583803166Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-304"],"updated_at":"2026-11-02T15:45:03.424067Z"},{"id":"GHSA-v468-qcjx-r72w","title":"Apache HttpClient accepts SCRAM-SHA-256 authentication without proper mutual authentication verification","description":"Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.","status":"published","published":"2026-04-22T09:31:31Z","modified":"2026-09-10T03:51:03.206251606Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-304"],"updated_at":"2026-11-02T15:46:56.639206Z"},{"id":"RHLW-2026-2a7b95611000d6b5","title":"Lightwell Security Advisory: httpclient5 5.6.0.rhlw-00001","description":"Red Hat Lightwell has released org.apache.httpcomponents.client5:httpclient5 5.6.0.rhlw-00001 with backported fixes for CVE-2026-40542 and CVE-2026-64607.\n\nCVE-2026-40542: Apache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to accept authentication without proper mutual authentication verification\n\nCVE-2026-64607: Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS\n\nThis patched artifact is a drop-in replacement for org.apache.httpcomponents.client5:httpclient5 5.6.0 from Maven Central.","status":"published","published":"2026-10-12T16:58:44Z","modified":"2026-10-27T04:13:01.828147266Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"UBUNTU-CVE-2026-40542","description":"Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.","status":"published","published":"2026-04-22T08:16:00Z","modified":"2026-10-17T12:58:53.771398033Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"},{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T16:56:16.686388Z"},{"id":"ROOT-APP-MAVEN-CVE-2026-40542","title":"CVE-2026-40542 in org.apache.httpcomponents.client5:httpclient5 - Patched by Root","description":"Root has patched CVE-2026-40542 in the org.apache.httpcomponents.client5:httpclient5 package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-10-08T11:59:45Z","modified":"2026-10-08T12:15:03.576481629Z","updated_at":"2026-11-02T15:53:27.066589Z"}]}}