CVE catalog
CVE-2026-40542
Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users
- Severity
- High · CVSS 7.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.54% · Oct 25, 2026
Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | httpcomponents-client | sid | 4.5.14-1 | not affected |
| Debian | httpcomponents-client | forky | 4.5.14-1 | not affected |
| Debian | httpcomponents-client | trixie | 4.5.14-1 | not affected |
| Debian | httpcomponents-client | bookworm | 4.5.14-1 | not affected |
| Cpe | httpclient | Not reported | Not reported | unknown |
| Cpe | httpclient | Not reported | Not reported | unknown |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | httpcomponents-client | source | sid | Not affected | unimportant | Not reported | Not reported |
| Debian | httpcomponents-client | source | forky | Not affected | unimportant | Not reported | Not reported |
| Debian | httpcomponents-client | source | trixie | Not affected | unimportant | Not reported | Not reported |
| Debian | httpcomponents-client | source | bookworm | Not affected | unimportant | Not reported | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [libhttpclient-java]Not affected
Source package: [httpcomponents-client]
Details (2)
4.5.14-1· all · bookwormNot affected
nvd · httpcomponents-client · debian · bookworm
4.5.14-1· all · bookwormNot affected
nvd · httpcomponents-client · debian · bookworm
- [libhttpmime-java]Not affected
Source package: [httpcomponents-client]
Details (2)
4.5.14-1· all · bookwormNot affected
nvd · httpcomponents-client · debian · bookworm
4.5.14-1· all · bookwormNot affected
nvd · httpcomponents-client · debian · bookworm
Observed:
References
- [http://www.openwall.com/lists/oss-security/2026/04/22/5]
- [https://access.redhat.com/errata/RHSA-2026:60239]
- [https://access.redhat.com/errata/RHSA-2026:60246]
- [https://access.redhat.com/errata/RHSA-2026:60247]
- [https://access.redhat.com/errata/RHSA-2026:60248]
- [https://access.redhat.com/errata/RHSA-2026:60249]
- [https://access.redhat.com/errata/RHSA-2026:60250]
- [https://access.redhat.com/errata/RHSA-2026:60251]
- [https://access.redhat.com/errata/RHSA-2026:60252]
- [https://access.redhat.com/errata/RHSA-2026:60254]
- [https://access.redhat.com/errata/RHSA-2026:60256]
- [https://access.redhat.com/errata/RHSA-2026:60259]
- [https://access.redhat.com/security/cve/CVE-2026-40542]
- [https://bugzilla.redhat.com/show_bug.cgi?id=2460518]
- [https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-40542]
- [https://security-tracker.debian.org/tracker/CVE-2026-40542]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40542.json]
[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [Red Hat security advisories and VEX]