NetSight
IP …
high7.3

CVE-2026-40542

Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper m…

Impact

Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.apache.httpcomponents.client5:httpclient5>= 5.6-alpha1, < 5.6.15.6.1

Affected products

VendorProductAffected versions
ApacheHttpclient
Version 5.6

Weakness classification

CWE-304CWE-325

References