← Vulnerability feed

Vulnerability record · CVE-2026-40542 · published 22 April 2026

CVE-2026-40542: Apache httpclient vulnerability

Apache · Httpclient

Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.

7.3 CVSS 3.1 High EPSS 0.70% · top 48.7% CWE-304 · CWE-304CWE-325 · CWE-325
7.3CVSS 3.1 base score
0.70%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
16References
9 Sep 2026Last modified by NVD

Description

Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97 Mailing ListVendor Advisory
http://www.openwall.com/lists/oss-security/2026/04/22/5 Mailing ListThird Party Advisory
https://access.redhat.com/errata/RHSA-2026:60239
https://access.redhat.com/errata/RHSA-2026:60246
https://access.redhat.com/errata/RHSA-2026:60247
https://access.redhat.com/errata/RHSA-2026:60248
https://access.redhat.com/errata/RHSA-2026:60249
https://access.redhat.com/errata/RHSA-2026:60250
https://access.redhat.com/errata/RHSA-2026:60251
https://access.redhat.com/errata/RHSA-2026:60252
https://access.redhat.com/errata/RHSA-2026:60254
https://access.redhat.com/errata/RHSA-2026:60256
https://access.redhat.com/errata/RHSA-2026:60259
https://access.redhat.com/security/cve/CVE-2026-40542
https://bugzilla.redhat.com/show_bug.cgi?id=2460518
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40542.json

Track CVE-2026-40542 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2013-4366Apache httpclient improper input validation vulnerabilityhttp/impl/client/HttpClientBuilder.java in Apache HttpClient 4.3.x before 4.3.1 does not ensure that X509HostnameVerifier is not null, which allows a…EPSS 3.3%9.1CVE-2026-71290Apache httpclient improper certificate validation vulnerabilityImproper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effe…EPSS 0.33%7.5CVE-2025-27820Apache httpclient improper certificate validation vulnerabilityA bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification. Discovered b…EPSS 0.95%5.8CVE-2014-3577Apache httpclient vulnerabilityorg.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify …EPSS 9.1%5.8CVE-2012-5783Apache httpclient improper certificate validation vulnerabilityApache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the serve…EPSS 9.3%5.3CVE-2026-64607Apache httpclient vulnerabilityHttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an inv…EPSS 0.46%5.3CVE-2020-13956Apache httpclient vulnerabilityApache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as …EPSS 9.0%4.3CVE-2015-5262Canonical ubuntu linux vulnerabilityhttp/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting …EPSS 19%

Source: NIST National Vulnerability Database (record CVE-2026-40542), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.