Skip to content
Fencer Vulns
high 7.3

CVE-2026-40542 json

Apache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to accept authentication without proper mutual authentication verification

published 2026-04-22 6 mo ago modified 2026-10-26 13 d ago also EUVD-2026-24630 , GHSA-v468-qcjx-r72w

cvss
7.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 45%
public exploits
0
none known

Summary

Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.

Patch / fix

  • maven org.apache.httpcomponents.client5:httpclient5 5.6.1
  • Apache Software Foundation Apache HttpClient 5.6.1
  • Red Hat OpenShift Developer Tools and Services 4.12 1786628667
  • Red Hat OpenShift Developer Tools and Services 4.13 1786628681
  • Red Hat OpenShift Developer Tools and Services 4.14 1786533561
  • Red Hat OpenShift Developer Tools and Services 4.15 1786533565
  • Red Hat OpenShift Developer Tools and Services 4.16 1787125166
  • Red Hat OpenShift Developer Tools and Services 4.17 1787124635
  • Red Hat OpenShift Developer Tools and Services 4.18 1787125069
  • Red Hat OpenShift Developer Tools and Services 4.19 1787124632
  • Red Hat OpenShift Developer Tools and Services 4.20 1787124925
  • Red Hat OpenShift Developer Tools and Services 4.21 1787125311
  • Red Hat OpenShift Developer Tools and Services 4.22 1787124779

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-40542 updated cvss 7.3

httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification

  • Red Hat OpenShift Developer Tools and Services jenkins, jenkins-2-plugins
    affected: no fix available
  • Red Hat OpenShift Developer Tools and Services 4.12 ocp-tools-4/jenkins-rhel8 1786628667
    fixed: vendor fix RHSA-2026:60247
  • Red Hat OpenShift Developer Tools and Services 4.13 ocp-tools-4/jenkins-rhel8 1786628681
    fixed: vendor fix RHSA-2026:60249
  • Red Hat OpenShift Developer Tools and Services 4.14 ocp-tools-4/jenkins-rhel8 1786533561
    fixed: vendor fix RHSA-2026:60248
  • Red Hat OpenShift Developer Tools and Services 4.15 ocp-tools-4/jenkins-rhel8 1786533565
    fixed: vendor fix RHSA-2026:60239
  • Red Hat OpenShift Developer Tools and Services 4.16 ocp-tools-4/jenkins-rhel9 1787125166
    fixed: vendor fix RHSA-2026:60251
  • Red Hat OpenShift Developer Tools and Services 4.17 ocp-tools-4/jenkins-rhel9 1787124635
    fixed: vendor fix RHSA-2026:60246
  • Red Hat OpenShift Developer Tools and Services 4.18 ocp-tools-4/jenkins-rhel9 1787125069
    fixed: vendor fix RHSA-2026:60250
show 5 more
  • Red Hat OpenShift Developer Tools and Services 4.19 ocp-tools-4/jenkins-rhel9 1787124632
    fixed: vendor fix RHSA-2026:60252
  • Red Hat OpenShift Developer Tools and Services 4.20 ocp-tools-4/jenkins-rhel9 1787124925
    fixed: vendor fix RHSA-2026:60259
  • Red Hat OpenShift Developer Tools and Services 4.21 ocp-tools-4/jenkins-rhel9 1787125311
    fixed: vendor fix RHSA-2026:60254
  • Red Hat OpenShift Developer Tools and Services 4.22 ocp-tools-4/jenkins-rhel9 1787124779
    fixed: vendor fix RHSA-2026:60256
  • Red Hat Cryostat 4 httpclient Red Hat Migration Toolkit for Applications 8 mta/mta-cli-rhel9, mta/mta-java-external-provider-rhel9 Red Hat OpenShift Developer Tools and Services 4.12 ocp-tools-4/jenkins-agent-base-rhel8 1786628706 Red Hat OpenShift Developer Tools and Services 4.13 ocp-tools-4/jenkins-agent-base-rhel8 1786628711 Red Hat OpenShift Developer Tools and Services 4.14 ocp-tools-4/jenkins-agent-base-rhel8 1786628748 Red Hat OpenShift Developer Tools and Services 4.15 ocp-tools-4/jenkins-agent-base-rhel8 1786628726
    +22 more products
    Red Hat OpenShift Developer Tools and Services 4.16 ocp-tools-4/jenkins-agent-base-rhel9 1787124634 Red Hat OpenShift Developer Tools and Services 4.17 ocp-tools-4/jenkins-agent-base-rhel9 1787124986 Red Hat OpenShift Developer Tools and Services 4.18 ocp-tools-4/jenkins-agent-base-rhel9 1787124633 Red Hat OpenShift Developer Tools and Services 4.19 ocp-tools-4/jenkins-agent-base-rhel9 1787124663 Red Hat OpenShift Developer Tools and Services 4.20 ocp-tools-4/jenkins-agent-base-rhel9 1787125493 Red Hat OpenShift Developer Tools and Services 4.21 ocp-tools-4/jenkins-agent-base-rhel9 1787125679 Red Hat OpenShift Developer Tools and Services 4.22 ocp-tools-4/jenkins-agent-base-rhel9 1787125563 Red Hat OpenShift Serverless openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9, openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9, openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9, openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9, openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9, openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9 Red Hat AMQ Broker 7 httpclient Red Hat AMQ Clients httpclient Red Hat build of Apache Camel - HawtIO 4 httpclient Red Hat build of Apache Camel 4 for Quarkus 3 httpclient, httpclient-cache Red Hat build of Apache Camel for Spring Boot 4 httpclient, httpclient-cache Red Hat build of Apicurio Registry 2 httpclient Red Hat build of Apicurio Registry 3 httpclient Red Hat build of Debezium 3 httpclient Red Hat build of OptaPlanner 8 httpclient Red Hat build of Quarkus httpclient Red Hat Certificate System 10 redhat-pki Red Hat Data Grid 8 httpclient, httpclient-cache Red Hat Enterprise Linux 7 maven-doxia, maven-wagon, maven-wagon-scm, maven-doxia-core, maven-doxia-tests, maven-doxia-javadoc, +17 more Red Hat Enterprise Linux 8 resteasy, maven-doxia, maven-wagon, maven-resolver, maven-wagon-ftp, maven-doxia-core, +36 more
    not affected: vulnerable code not present

18 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
6 mo ago

Exploit prediction

0.54% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
GitHub 3.1 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CNA 3.1 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Affected packages

ecosystem package affected fixed in
maven org.apache.httpcomponents.client5:httpclient5
>=5.6-alpha1, <5.6.1
5.6.1

Affected products

  • Apache Software Foundation Apache HttpClient
  • Red Hat OpenShift Developer Tools and Services 4.12
  • Red Hat OpenShift Developer Tools and Services 4.13
  • Red Hat OpenShift Developer Tools and Services 4.14
  • Red Hat OpenShift Developer Tools and Services 4.15
  • Red Hat OpenShift Developer Tools and Services 4.16
  • Red Hat OpenShift Developer Tools and Services 4.17
  • Red Hat OpenShift Developer Tools and Services 4.18
  • Red Hat OpenShift Developer Tools and Services 4.19
  • Red Hat OpenShift Developer Tools and Services 4.20
  • Red Hat OpenShift Developer Tools and Services 4.21
  • Red Hat OpenShift Developer Tools and Services 4.22
  • Red Hat Cryostat 4
  • Red Hat Migration Toolkit for Applications 8
  • Red Hat OpenShift Developer Tools and Services
  • Red Hat OpenShift Serverless
  • Red Hat Red Hat AMQ Broker 7
  • Red Hat Red Hat AMQ Clients
  • Red Hat Red Hat build of Apache Camel 4 for Quarkus 3
  • Red Hat Red Hat build of Apache Camel for Spring Boot 4
  • Red Hat Red Hat build of Apache Camel - HawtIO 4
  • Red Hat Red Hat build of Apicurio Registry 2
  • Red Hat Red Hat build of Apicurio Registry 3
  • Red Hat Red Hat build of Debezium 3
  • Red Hat Red Hat build of OptaPlanner 8
  • Red Hat Red Hat build of Quarkus
  • Red Hat Red Hat Certificate System 10
  • Red Hat Red Hat Data Grid 8
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Fuse 7
  • Red Hat Red Hat JBoss Core Services
  • Red Hat Red Hat JBoss Enterprise Application Platform 7
  • Red Hat Red Hat JBoss Enterprise Application Platform 8
  • Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Red Hat JBoss Web Server 5
  • Red Hat Red Hat JBoss Web Server 6
  • Red Hat Red Hat Lightspeed for Runtimes Operator
  • Red Hat Red Hat Offline Knowledge Portal
  • Red Hat Red Hat OpenShift AI (RHOAI)
  • Red Hat Red Hat OpenShift Dev Spaces
  • Red Hat Red Hat Process Automation 7
  • Red Hat Red Hat Satellite 6
  • Red Hat Red Hat Single Sign-On 7
  • Red Hat streams for Apache Kafka 2
  • Red Hat streams for Apache Kafka 3

Classification

Weakness
  • CWE-304 Missing Critical Step in Authentication
  • CWE-325 Missing Cryptographic Step
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.