What’s Vulnerable › Vulnerabilities

CVE-2026-40542: Apache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to accept authentication without proper mutual authentication verification

• Severity: high (CVSS 7.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-22 · updated 2026-10-26
• Weakness: CWE-304

Description

Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.

Affected products

• Apache Software Foundation Apache HttpClient: 5.6

References

• https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97
• http://www.openwall.com/lists/oss-security/2026/04/22/5
• https://access.redhat.com/errata/RHSA-2026:60239
• https://access.redhat.com/errata/RHSA-2026:60246
• https://access.redhat.com/errata/RHSA-2026:60247
• https://access.redhat.com/errata/RHSA-2026:60248
• https://access.redhat.com/errata/RHSA-2026:60249
• https://access.redhat.com/errata/RHSA-2026:60250
• https://access.redhat.com/errata/RHSA-2026:60251
• https://access.redhat.com/errata/RHSA-2026:60252
• https://access.redhat.com/errata/RHSA-2026:60254
• https://access.redhat.com/errata/RHSA-2026:60256

Get alerted when CVE-2026-40542 or the next vulnerability affects your stack