Skip to main content

Apache HttpClient CVE-2026-40542

| EUVDEUVD-2026-24630 HIGH
Missing Critical Step in Authentication (CWE-304)
2026-04-22 apache GHSA-v468-qcjx-r72w
Information Disclosure Apache Apache Httpclient
7.3
CVSS 3.1 · Vendor: apache
Share

Severity by source

Vendor (apache) PRIMARY
7.3 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
SUSE
HIGH
qualitative
Red Hat
7.3 HIGH
qualitative

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low

Lifecycle Timeline

8
Patch released
May 01, 2026 - 17:12 nvd
Patch available
Re-analysis Queued
Apr 22, 2026 - 17:22 vuln.today
cvss_changed
Analysis Generated
Apr 22, 2026 - 15:22 vuln.today
CVSS changed
Apr 22, 2026 - 15:22 NVD
7.3 (HIGH)
Patch available
Apr 22, 2026 - 09:01 EUVD
EUVD ID Assigned
Apr 22, 2026 - 08:00 euvd
EUVD-2026-24630
Analysis Generated
Apr 22, 2026 - 08:00 vuln.today
CVE Published
Apr 22, 2026 - 07:07 nvd
HIGH 7.3

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 4 maven packages depend on org.apache.httpcomponents.client5:httpclient5 (4 direct, 0 indirect)

Ecosystem-wide dependent count for version 5.6-alpha1.

DescriptionCVE.org

Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.

AnalysisAI

Apache HttpClient 5.6 skips mutual authentication verification in SCRAM-SHA-256 handshakes, allowing network attackers to impersonate legitimate servers without credentials. Affected clients accept unauthenticated server responses, enabling man-in-the-middle attacks that compromise confidentiality and integrity of authenticated sessions. Apache released patched version 5.6.1 addressing the missing authentication check. EPSS score of 0.03% suggests low current exploitation activity, though the network-accessible attack surface (AV:N/AC:L/PR:N) and availability of detailed vendor advisory increase exploitation risk once attackers adapt tooling for SCRAM protocol manipulation.

Technical ContextAI

SCRAM-SHA-256 (Salted Challenge Response Authentication Mechanism) is a mutual authentication protocol where both client and server prove identity through cryptographic challenge-response exchanges. CWE-304 (Missing Critical Step in Authentication) indicates Apache HttpClient 5.6 fails to validate server proof messages during the final SCRAM handshake phase. Per CPE data, this affects apache_httpclient 5.6 specifically in the a:apache_software_foundation namespace. The vulnerability allows attackers to complete authentication flows without possessing valid credentials by exploiting the client's incomplete verification logic. SCRAM protocols rely on both client and server computing matching proof values derived from shared secrets - omitting server proof validation breaks the mutual authentication guarantee that distinguishes SCRAM from simpler challenge-response schemes.

RemediationAI

Upgrade Apache HttpClient to version 5.6.1 immediately, as confirmed by Apache Software Foundation advisory at https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97. For environments unable to apply the patch, implement network-level compensating controls by restricting HttpClient connections to explicitly trusted server IP addresses using firewall rules or application-layer allowlists, reducing man-in-the-middle attack surface. Alternatively, disable SCRAM-SHA-256 authentication and migrate to TLS client certificate authentication or OAuth 2.0 flows that do not rely on HttpClient's SCRAM implementation, though this requires application code changes and may break compatibility with backend services expecting SCRAM credentials. Monitor authentication failures and unexpected certificate warnings as potential exploitation indicators. No workaround fully mitigates risk without patching - compensating controls only reduce attack surface.

Same weakness CWE-304 – Missing Critical Step in Authentication

View all
CVE-2024-8954 CRITICAL POC
9.8
CVE-2024-12048 HIGH POC
8.8
CVE-2022-40622 HIGH POC
8.8
CVE-2022-1065 HIGH POC
8.8
CVE-2022-2821 HIGH POC
7.5
CVE-2024-2172 CRITICAL
9.8
CVE-2024-45764 CRITICAL
9.8
CVE-2022-2302 CRITICAL
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed
SUSE Linux Enterprise Server 16.0 Fixed

Share

CVE-2026-40542 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy