CVE-2026-40542: Apache Httpclient

High severity, CVSS 7.3. EPSS: 0.7% chance of exploitation in the next 30 days.

Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.

Affected products

• Apache Httpclient: version 5.6 only

Published 2026-04-22. Last modified 2026-09-09.