CVE-2026-40542

—

CVSS 3.1

7.3 high

EPSS

<1%p45

Published

Apr 22, 2026 (Apr 22, 2026)

Modified

Sep 9, 2026

Description

Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.

Vendors: apache
Products: httpclient
Weakness: CWE-304, CWE-325
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

NVD CVE.org GitHub PoCs EPSS (0.6%)

In the news0 stories

No ingested article mentions this CVE yet.