GHSA-v468-qcjx-r72w

Apache HttpClient accepts SCRAM-SHA-256 authentication without proper mutual authentication verification

Source: GitHub Advisory Database (reviewed) High CVE-2026-40542

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.apache.httpcomponents.client5:httpclient5	>= 5.6-alpha1, < 5.6.1	5.6.1

Details

As written in the advisory (Markdown source, shown as plain text).

Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2026-40542 advisory
https://github.com/apache/httpcomponents-client/commit/726eac2323d370435d8afca1e0540aa099927f18 web
https://github.com/apache/httpcomponents-client package
https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97 web
http://www.openwall.com/lists/oss-security/2026/04/22/5 web