CVE Feed

    Dashboard / CVE / CVE-2026-40542

    CVE-2026-40542

    Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.

    Published:Apr 22, 2026
    Last Modified:Aug 27, 2026
    EPS:Apr 22, 2026
    EPSS Score:0.00537
    CVSS Score:7.3

    Affected Products

    Vendor
    Apache
    Product
    Httpclient

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-68 Subvert Code-signing Facilities

    Related CVEs

    CVE-2026-71290 (CVSS 9.1) — Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerific…
    CVE-2026-64607 (CVSS 5.3) — HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the con…
    CVE-2025-27820 (CVSS 7.5) — A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management a…
    CVE-2020-13956 (CVSS 5.3) — Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in…
    CVE-2013-4366 (CVSS 9.8) — http/impl/client/HttpClientBuilder.java in Apache HttpClient 4.3.x before 4.3.1 does not ensure that X509Hostn…
    CVE-2015-5262 (CVSS 4.3) — http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the htt…
    CVE-2014-3577 (CVSS 5.8) — org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient…
    CVE-2012-5783 (CVSS 5.8) — Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other p…
    CVE-2011-1498 (CVSS 4.3) — Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used with an authenticating proxy server, se…

    References

    https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97
    http://www.openwall.com/lists/oss-security/2026/04/22/5
    https://access.redhat.com/errata/RHSA-2026:60239
    https://access.redhat.com/errata/RHSA-2026:60246
    https://access.redhat.com/errata/RHSA-2026:60247
    https://access.redhat.com/errata/RHSA-2026:60248
    https://access.redhat.com/errata/RHSA-2026:60249
    https://access.redhat.com/errata/RHSA-2026:60250
    https://access.redhat.com/errata/RHSA-2026:60251
    https://access.redhat.com/errata/RHSA-2026:60252
    https://access.redhat.com/errata/RHSA-2026:60254
    https://access.redhat.com/errata/RHSA-2026:60256
    https://access.redhat.com/errata/RHSA-2026:60259
    https://access.redhat.com/security/cve/CVE-2026-40542
    https://bugzilla.redhat.com/show_bug.cgi?id=2460518
    https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40542.json

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High