CVE-2026-40542: Apache HttpClient 5.6 Vulnerability in SCRAM-SHA-256 Authentication
Summary
CVE-2026-40542: Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Affects org.apache.httpcomponents.client5:httpclient5 versions >= 5.6-alpha1, < 5.6.1. Fixed in 5.6.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HttpClient is a widely used library in Java for making HTTP requests. It provides a robust and flexible framework for handling HTTP connections, supporting various authentication methods, including SCRAM-SHA-256. However, a critical vulnerability has been identified in version 5.6, which compromises the mutual authentication process, potentially allowing unauthorized access.
Vulnerability Detail
The vulnerability arises from a missing critical step in the authentication process within Apache HttpClient 5.6. This flaw allows an attacker to exploit the SCRAM-SHA-256 authentication mechanism, leading the client to accept authentication without proper mutual verification. As a result, this could enable unauthorized users to gain access to sensitive data or perform actions on behalf of legitimate users, posing significant security risks.
How To Fix
Latest published version: 5.7-beta1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.6.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to upgrade to the patched version as soon as possible.
Conclusion
In summary, CVE-2026-40542 is a significant vulnerability in Apache HttpClient 5.6 that affects the SCRAM-SHA-256 authentication process. Users are urged to upgrade to version 5.6.1 to mitigate the risks associated with this vulnerability.
See every vulnerability recorded for org.apache.httpcomponents.client5:httpclient5 →
FAQ
CVE-2026-40542 is a vulnerability in Apache HttpClient 5.6 that allows improper mutual authentication verification in SCRAM-SHA-256 authentication.
You can use Vulert, which monitors open-source vulnerabilities in your software. By simply checking your pom.xml file, you can determine if your application is affected.
The risks include unauthorized access to sensitive data and the potential for attackers to perform actions on behalf of legitimate users.
Yes, a patch is available in version 5.6.1 of Apache HttpClient. Users are strongly advised to upgrade to this version.
The CVSS score for this vulnerability is 7.3, indicating a high level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.httpcomponents.client5:httpclient5.
