Apache HttpClient accepts SCRAM-SHA-256 authentication without proper mutual authentication verification

ALTO 7.3CVE-2026-40542 · GHSA-v468-qcjx-r72w · Published 22/04/2026 · updated 26/10/2026

In breve

CVE-2026-40542 è una vulnerabilità ALTO (CVSS 7.3) che riguarda org.apache.httpcomponents.client5:httpclient5, httpclient (apache).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.54%, superiore al 45.2% delle vulnerabilità.
Correzione: aggiornare a 5.6.1 o successiva.

Package	Affected versions	Patched versions
org.apache.httpcomponents.client5:httpclient5 Maven	`≥ 5.6-alpha1, < 5.6.1`	`5.6.1`
httpclient apache	`= 5.6`	No fix yet

Description

Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.

NVD description

References

Altre vulnerabilità di org.apache.httpcomponents.client5:httpclient5

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free