> CVE-2026-40542

« BACK_TO_HOME
PUBLISHED
2026-04-22 08:16
MODIFIED
2026-04-22 08:16
EPSS (Prob. Exploit)
0.70%
Top 47.2%
DATA SOURCES:
NVD 🔗 2026-04-22 CWE MITRE 🔗 2026-11-01 FIRST EPSS 🔗 2026-10-25 GITHUB 🔗 2026-11-05 OSV 🔗 2026-09-13

> DESCRIPTION

Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> WEAKNESSES

CWE-304

> CWE DETAILED DESCRIPTIONS

CWE-304: Missing Critical Step in Authentication - The product implements an authentication technique, but it skips a step that weakens the technique.

> RED HAT SECURITY ADVISORIES

Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.20 security update.
An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.20.
Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.22 security update.
An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.22.
Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.21 security update.
An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.21.
Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.19 security update.
An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.19.
Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.16 security update.
An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.16.
Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.18 security update.
An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.18.
Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.13 security update.
An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13.
Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.14 security update.
An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14.
Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.12 security update.
An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.12.
Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.17 security update.
An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.17.
Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.15 security update.
An update for Openshift Jenkins is now available for Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.15.

> GITHUB SECURITY ADVISORY

GHSA-v468-qcjx-r72w HIGH

Apache HttpClient accepts SCRAM-SHA-256 authentication without proper mutual authentication verification

AFFECTED PACKAGES:
MAVEN / org.apache.httpcomponents.client5:httpclient5
>= 5.6-alpha1, < 5.6.1
Fixed in: 5.6.1

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

Apache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to accept authentication without proper mutual authentication verification

AFFECTED PACKAGES:
Unknown / Unknown
3 versions affected
ALIASES:
GHSA-v468-qcjx-r72w

> HISTORIQUE DES MODIFICATIONS

Première apparition
22/04/2026 08:16
Source: NVD
📊 ENRICHISSEMENT 01/05/2026 06:01
CWE
Champ modifié: Description CWE
Ancienne valeur:
N/A
Nouvelle valeur:
CWE-304: Missing Critical Step in Authentication - The product implements an authentication technique, but it skips a step that weakens the technique.
Total des modifications: 1 Dernière mise à jour: 6 months ago

> REFERENCES

https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97
« BACK_TO_HOME