Skip to content
OpenAdvisories
High · 7.3 CVE-2026-40542 EUVD-2026-24630GHSA-v468-qcjx-r72w

Apache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to accept authentication without proper mutual authentication verification

Published Apr 22, 2026 · Updated Sep 9, 2026 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache HttpClient Package: apache-nifi Package: dependency-track Package: dependency-track-bundled Package: httpcomponents-client Package: opensearch-3 Package: opensearch-3-alerting Package: opensearch-3-anomaly-detection Package: opensearch-3-cross-cluster-replication Package: opensearch-3-k-nn Package: opensearch-3-ml-commons Package: opensearch-3-notifications Package: opensearch-3-security Package: opensearch-3-sql Package: org.apache.httpcomponents.client5:httpclient5 Package: trino-plugin-clickhouse Package: trino-plugin-delta-lake Package: trino-plugin-druid Package: trino-plugin-hive Package: trino-plugin-hudi Package: trino-plugin-iceberg Package: trino-plugin-kafka Package: trino-plugin-lakehouse Package: trino-plugin-openlineage Package: trino-plugin-pinot Ecosystem: Maven Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache HttpClient 5.6 – < 5.6.1 5.6.1

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 httpcomponents-client No fix yet —
Ubuntu 26.04 LTS httpcomponents-client No fix yet —
Ubuntu 25.10 httpcomponents-client No fix yet —
Ubuntu 24.04 LTS httpcomponents-client No fix yet —
Ubuntu 22.04 LTS httpcomponents-client No fix yet —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS httpcomponents-client No fix yet —
Ubuntu Pro 18.04 LTS httpcomponents-client No fix yet —
Ubuntu Pro 16.04 LTS httpcomponents-client No fix yet —
Ubuntu Pro 14.04 LTS httpcomponents-client No fix yet —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling apache-nifi 2.9.0-r7 —
Wolfi rolling dependency-track +1 4.14.1-r2 —
Wolfi rolling opensearch-3 +8 3.6.0-r2 —
Wolfi rolling trino-plugin-hive +9 481-r0 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.httpcomponents.client5:httpclient5 >= 5.6-alpha1, < 5.6.1 5.6.1 GHSA-v468-qcjx-r72w

Advisories 1

References