HIGH7.3

GHSA-v468-qcjx-r72w

Apache HttpClient accepts SCRAM-SHA-256 authentication without proper mutual authentication verification

Quick fix

GHSA-v468-qcjx-r72w — org.apache.httpcomponents.client5:httpclient5: upgrade to the fixed version with the command below.

# pom.xml: bump <version>5.6.1</version> for org.apache.httpcomponents.client5:httpclient5

Details

Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.

Are you affected?

Enter the version of the package you're using.

Affected packages

Maven/org.apache.httpcomponents.client5:httpclient5

Introduced in: 5.6-alpha1Fixed in: 5.6.1

Fix# pom.xml: bump <version>5.6.1</version> for org.apache.httpcomponents.client5:httpclient5

References

https://nvd.nist.gov/vuln/detail/CVE-2026-40542[ADVISORY]
https://github.com/apache/httpcomponents-client/commit/726eac2323d370435d8afca1e0540aa099927f18[WEB]
https://github.com/apache/httpcomponents-client[PACKAGE]
https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97[WEB]
http://www.openwall.com/lists/oss-security/2026/04/22/5[WEB]