CVE-2026-40542: apache software foundation apache httpclient Missing Critical Step in Authentication
CVSS: 7.3v3.1HighModified
AliasesUBUNTU-CVE-2026-40542CGA-29rf-75wv-88r6CGA-2gg3-jv85-r97rCGA-2gpp-v6p7-gc6wCGA-2pv8-cx6j-f997CGA-366q-29rm-3xwxCGA-3739-894h-r956CGA-3jwm-37cg-c8g2CGA-3qf2-m6xx-xx5qCGA-48h5-6hj6-6j9xCGA-4x49-m3fq-rh5gCGA-4xqm-x4hg-4jf8CGA-5834-6fvx-vch7CGA-5ghw-h6hv-p3ghCGA-63gv-3xp7-54fcCGA-6hg9-hq33-q6hpCGA-7r5f-fgrg-c2cqCGA-7rxm-pcfc-5mm3CGA-834m-vjfc-5mp9CGA-836j-cpvw-6v52CGA-84f9-vjg7-hchpCGA-8w6v-g8g3-v3mxCGA-9247-grjh-7cwgCGA-9hcm-hcr8-mcfxCGA-9vcm-wrgc-vw8jCGA-9xj6-c6px-x35wCGA-c2m3-j9wf-jj75CGA-f396-7x43-9w77CGA-fg8q-v9rf-m66mCGA-fjwj-mpp5-j545CGA-fmff-mq99-q7m2CGA-h24g-phjx-qm9xCGA-h7g2-rfwm-qvcgCGA-hggr-g4q9-f63fCGA-hqjc-ggm2-37qxCGA-j483-mwwp-mhwfCGA-j865-9rmc-hf8pCGA-jh66-7v43-j4vvCGA-m48g-vw82-wv7qCGA-m9g9-46cg-m9h9CGA-mfr2-3cc3-5968CGA-mmhw-fc72-qmxpCGA-qqv3-cv94-7jcjCGA-rq7w-ghrx-qm3rCGA-rrmv-wvr3-c67jCGA-v2fx-qmg5-m85xCGA-v363-vfph-hc37CGA-x9qw-8r6v-mvv6CGA-xp79-cx47-cf72CGA-2444-g8jg-gg4cCGA-39m8-7mmr-26whCGA-4472-rfj6-c6f6CGA-46w3-wqjh-2wxjCGA-47vh-37vm-4j5hCGA-4jrc-qwgg-2gpjCGA-4mjx-f7cq-qjc5CGA-4xcp-w2qq-6c46CGA-6pp8-jvpp-2v9mCGA-7q69-m7j8-x979CGA-92f2-fqwc-g7rvCGA-998c-prxr-c2hwCGA-chhf-9w4m-3hphCGA-f9gp-588j-x6r7CGA-fmm8-729j-m4rpCGA-fqwv-3946-x334CGA-g2x6-9c57-jjm2CGA-g8gc-f9rf-w5phCGA-gf49-m435-5mh9CGA-hr5q-gj7m-gx5xCGA-hx38-mr85-fwrvCGA-j2p3-vxg6-hh3vCGA-j3gp-38rh-3j32CGA-mmrm-mpj4-gpg8CGA-mvjh-pj7p-3h29CGA-prhq-mf47-cg5jCGA-pv3j-73q2-f67fGHSA-v468-qcjx-r72wCGA-qh93-g4cv-f5m8CGA-qp44-6gvp-f5j2CGA-qvvp-xx94-58qqCGA-vm4g-jfw2-cmmq
Published 22-04-2026Last modified 09-09-2026
Vulnerability summary
CVE-2026-40542 is a high (CVSS 7.3) Missing Critical Step in Authentication vulnerability in apache software foundation apache httpclient. EPSS estimates a 0.70% chance of exploitation in the next 30 days, higher than 52.4% of scored vulnerabilities.
CVSS score
7.3/10
010
High · v3.1 (CVE.org)EPSS score
0.70%
0%100%
Low · +0.14 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 22-04-2026PublishedVulnerability first disclosed.
- 09-09-2026Last modifiedVulnerability information updated.
Description
Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.
CVSS metrics
6 scores · 6 sources · 1 versionHigh 7.3Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LSourcesAll 6 agree
- OSV · UbuntuEcosystem advisory · calculated7.3HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- OSV · WolfiEcosystem advisory · calculated7.3HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- OSV · ChainguardEcosystem advisory · calculated7.3HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- OSV · MavenEcosystem advisory · calculated7.3HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- NVDNIST7.3HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS trend
Probability
0.70%
Chance of exploitation in the next 30 days
Percentile
52%
Versus all other CVEs
30-day change
+0.14 pp
From 0.56% on 20-09-2026
20-09-202620-10-2026
EPSS score0.70%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-304Missing Critical Step in AuthenticationThe product implements an authentication technique, but it skips a step that weakens the technique.
- CWE-325Missing Cryptographic StepThe product does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by the algorithm.
Affected systems
Chainguard35 products
- apache-nifi< 2.9.0-r7
- dependency-track< 4.14.1-r2
- dependency-track-apiserver< 4.14.1-r1
- dependency-track-bundled< 4.14.1-r2
- jbang< 0.139.3-r1
Wolfi22 products
- apache-nifi< 2.9.0-r7
- dependency-track< 4.14.1-r2
- dependency-track-bundled< 4.14.1-r2
- opensearch-3< 3.6.0-r2
- opensearch-3-alerting< 3.6.0-r2
Apache1 product
- httpclient5.6
Apache software foundation1 product
- apache httpclient≥ 5.6, < 5.6.1
Org.apache.httpcomponents.client51 product
- httpclient5≥ 5.6-alpha1, < 5.6.1
Ubuntu1 product
- httpcomponents-clientAll versions (No fix recorded)
6 vendors · 61 products
References
23 links- lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97Vendor AdvisoryREPORTAdvisoryWEBMailing List
