CVE-2026-40542

HighCVSS 7.3

Published: 22/04/2026(UTC)Updated: 09/09/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.56%

45th percentile - higher than 45% of all known CVEs

Summary

In Apache HttpClient 5.6, a missing critical step in authentication allows an attacker to force the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. The issue is fixed in version 5.6.1.

Risk Assessment

The organization is at risk of man-in-the-middle attacks, where an attacker can impersonate the server and intercept credentials or session data.

Recommendation

Upgrade Apache HttpClient to version 5.6.1 or later immediately.

Other vulnerabilities in Apache HttpClient

CVE-2013-4366Critical
In Apache HttpClient versions 4.3.x before 4.3.1, it does not ensure that X509HostnameVerifier is not null, which may allow attackers to exploit vulnerabilities involving hostname verification.

Original NVD description (English source)

Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.