{"cvss":7.3,"datePublished":"2026-04-22T08:16:12.780","dateUpdated":"2026-10-26T21:10:00.170","description":"Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.","id":"CVE-2026-40542","raw":{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.httpcomponents.client5:httpclient5","product":"Apache HttpClient","vendor":"Apache Software Foundation","versions":[{"lessThan":"5.6.1","status":"affected","version":"5.6","versionType":"semver"}]}],"source":"security@apache.org"},{"affectedData":[{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ocp_tools:4.12::el8"],"defaultStatus":"affected","packageName":"ocp-tools-4/jenkins-rhel8","product":"OpenShift Developer Tools and Services 4.12","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1786628667","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ocp_tools:4.13::el8"],"defaultStatus":"affected","packageName":"ocp-tools-4/jenkins-rhel8","product":"OpenShift Developer Tools and Services 4.13","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1786628681","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ocp_tools:4.14::el8"],"defaultStatus":"affected","packageName":"ocp-tools-4/jenkins-rhel8","product":"OpenShift Developer Tools and Services 4.14","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1786533561","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ocp_tools:4.15::el8"],"defaultStatus":"affected","packageName":"ocp-tools-4/jenkins-rhel8","product":"OpenShift Developer Tools and Services 4.15","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1786533565","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ocp_tools:4.16::el9"],"defaultStatus":"affected","packageName":"ocp-tools-4/jenkins-rhel9","product":"OpenShift Developer Tools and Services 4.16","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1787125166","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ocp_tools:4.17::el9"],"defaultStatus":"affected","packageName":"ocp-tools-4/jenkins-rhel9","product":"OpenShift Developer Tools and Services 4.17","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1787124635","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ocp_tools:4.18::el9"],"defaultStatus":"affected","packageName":"ocp-tools-4/jenkins-rhel9","product":"OpenShift Developer Tools and Services 4.18","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1787125069","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ocp_tools:4.19::el9"],"defaultStatus":"affected","packageName":"ocp-tools-4/jenkins-rhel9","product":"OpenShift Developer Tools and Services 4.19","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1787124632","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ocp_tools:4.20::el9"],"defaultStatus":"affected","packageName":"ocp-tools-4/jenkins-rhel9","product":"OpenShift Developer Tools and Services 4.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1787124925","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ocp_tools:4.21::el9"],"defaultStatus":"affected","packageName":"ocp-tools-4/jenkins-rhel9","product":"OpenShift Developer Tools and Services 4.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1787125311","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ocp_tools:4.22::el9"],"defaultStatus":"affected","packageName":"ocp-tools-4/jenkins-rhel9","product":"OpenShift Developer Tools and Services 4.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1787124779","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:cryostat:4"],"defaultStatus":"unaffected","packageName":"httpclient","product":"Cryostat 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:migration_toolkit_applications:8"],"defaultStatus":"unaffected","packageName":"mta/mta-cli-rhel9","product":"Migration Toolkit for Applications 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:migration_toolkit_applications:8"],"defaultStatus":"unaffected","packageName":"mta/mta-java-external-provider-rhel9","product":"Migration Toolkit for Applications 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ocp_tools"],"defaultStatus":"affected","packageName":"jenkins","product":"OpenShift Developer Tools and Services","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ocp_tools"],"defaultStatus":"affected","packageName":"jenkins-2-plugins","product":"OpenShift Developer Tools and Services","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:serverless:1"],"defaultStatus":"unaffected","packageName":"openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9","product":"OpenShift Serverless","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:serverless:1"],"defaultStatus":"unaffected","packageName":"openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9","product":"OpenShift Serverless","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:serverless:1"],"defaultStatus":"unaffected","packageName":"openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9","product":"OpenShift Serverless","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:serverless:1"],"defaultStatus":"unaffected","packageName":"openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9","product":"OpenShift Serverless","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:serverless:1"],"defaultStatus":"unaffected","packageName":"openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9","product":"OpenShift Serverless","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:serverless:1"],"defaultStatus":"unaffected","packageName":"openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9","product":"OpenShift Serverless","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:amq_broker:7"],"defaultStatus":"unaffected","packageName":"httpclient","product":"Red Hat AMQ Broker 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:amq_clients:2023"],"defaultStatus":"unaffected","packageName":"httpclient","product":"Red Hat AMQ Clients","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:camel_quarkus:3"],"defaultStatus":"unaffected","packageName":"httpclient","product":"Red Hat build of Apache Camel 4 for Quarkus 3","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:camel_quarkus:3"],"defaultStatus":"unaffected","packageName":"httpclient-cache","product":"Red Hat build of Apache Camel 4 for Quarkus 3","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:camel_spring_boot:4"],"defaultStatus":"unaffected","packageName":"httpclient","product":"Red Hat build of Apache Camel for Spring Boot 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:camel_spring_boot:4"],"defaultStatus":"unaffected","packageName":"httpclient-cache","product":"Red Hat build of Apache Camel for Spring Boot 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:apache_camel_hawtio:4"],"defaultStatus":"unaffected","packageName":"httpclient","product":"Red Hat build of Apache Camel - HawtIO 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:service_registry:2"],"defaultStatus":"unaffected","packageName":"httpclient","product":"Red Hat build of Apicurio Registry 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:apicurio_registry:3"],"defaultStatus":"unaffected","packageName":"httpclient","product":"Red Hat build of Apicurio Registry 3","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:debezium:3"],"defaultStatus":"unaffected","packageName":"httpclient","product":"Red Hat build of Debezium 3","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:optaplanner:::el6"],"defaultStatus":"unaffected","packageName":"httpclient","product":"Red Hat build of OptaPlanner 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:quarkus:3"],"defaultStatus":"unaffected","packageName":"httpclient","product":"Red Hat build of Quarkus","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:certificate_system:10"],"defaultStatus":"unaffected","packageName":"redhat-pki:10/redhat-pki","product":"Red Hat Certificate System 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_data_grid:8"],"defaultStatus":"unaffected","packageName":"httpclient","product":"Red Hat Data Grid 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_data_grid:8"],"defaultStatus":"unaffected","packageName":"httpclient-cache","product":"Red Hat Data Grid 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"],"defaultStatus":"unaffected","packageName":"dogtag-pki","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"],"defaultStatus":"unaffected","packageName":"mod_proxy_cluster","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unaffected","packageName":"maven-changes-plugin","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unaffected","packageName":"maven-doxia","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unaffected","packageName":"maven-wagon","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"javapackages-tools:201801/httpcomponents-client","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"javapackages-tools:201801/maven-doxia","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"javapackages-tools:201801/maven-resolver","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"javapackages-tools:201801/maven-wagon","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"pki-core:10.6/resteasy","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"pki-deps:10.6/resteasy","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"jmc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"maven:3.9/httpcomponents-client","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"maven:3.9/maven","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"maven:3.9/maven-resolver","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"maven:3.9/maven-wagon","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"maven-resolver","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"maven-wagon","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"mod_proxy_cluster","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"pki-core","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"resteasy","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_fuse:7"],"defaultStatus":"unaffected","packageName":"httpclient","product":"Red Hat Fuse 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_fuse:7"],"defaultStatus":"unaffected","packageName":"httpclient-cache","product":"Red Hat Fuse 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_fuse:7"],"defaultStatus":"unaffected","packageName":"httpclient-osgi","product":"Red Hat Fuse 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_fuse:7"],"defaultStatus":"unaffected","packageName":"httpclient-win","product":"Red Hat Fuse 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_core_services:1"],"defaultStatus":"unaffected","packageName":"jbcs-httpd24-mod_cluster-native","product":"Red Hat JBoss Core Services","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_core_services:1"],"defaultStatus":"unaffected","packageName":"jbcs-httpd24-mod_proxy_cluster","product":"Red Hat JBoss Core Services","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"],"defaultStatus":"unaffected","packageName":"httpclient","product":"Red Hat JBoss Enterprise Application Platform 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"],"defaultStatus":"unaffected","packageName":"httpclient-cache","product":"Red Hat JBoss Enterprise Application Platform 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"],"defaultStatus":"unaffected","packageName":"httpclient-osgi","product":"Red Hat JBoss Enterprise Application Platform 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"],"defaultStatus":"unaffected","packageName":"httpclient-win","product":"Red Hat JBoss Enterprise Application Platform 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8"],"defaultStatus":"unaffected","packageName":"httpclient","product":"Red Hat JBoss Enterprise Application Platform 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8"],"defaultStatus":"unaffected","packageName":"httpclient-cache","product":"Red Hat JBoss Enterprise Application Platform 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8"],"defaultStatus":"unaffected","packageName":"httpclient-osgi","product":"Red Hat JBoss Enterprise Application Platform 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8"],"defaultStatus":"unaffected","packageName":"httpclient-win","product":"Red Hat JBoss Enterprise Application Platform 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jbosseapxp"],"defaultStatus":"unaffected","packageName":"httpclient","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jbosseapxp"],"defaultStatus":"unaffected","packageName":"httpclient-cache","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jbosseapxp"],"defaultStatus":"unaffected","packageName":"httpclient-osgi","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jbosseapxp"],"defaultStatus":"unaffected","packageName":"httpclient-win","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_web_server:5"],"defaultStatus":"unaffected","packageName":"httpclient","product":"Red Hat JBoss Web Server 5","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_web_server:5"],"defaultStatus":"unaffected","packageName":"jws5-mod_cluster","product":"Red Hat JBoss Web Server 5","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_web_server:6"],"defaultStatus":"unaffected","packageName":"httpclient","product":"Red Hat JBoss Web Server 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:lightspeed_for_runtimes:1"],"defaultStatus":"unaffected","packageName":"rh-lightspeed-runtimes/runtimes-agent-init-rhel9","product":"Red Hat Lightspeed for Runtimes Operator","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:offline_knowledge_portal:1"],"defaultStatus":"unaffected","packageName":"offline-knowledge-portal/rhokp-rhel9","product":"Red Hat Offline Knowledge Portal","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-trustyai-service-rhel8","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-trustyai-service-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_devspaces:3"],"defaultStatus":"unaffected","packageName":"devspaces/openvsx-rhel9","product":"Red Hat OpenShift Dev Spaces","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_devspaces:3"],"defaultStatus":"unaffected","packageName":"devspaces/pluginregistry-rhel9","product":"Red Hat OpenShift Dev Spaces","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_bpms_platform:7"],"defaultStatus":"unaffected","packageName":"httpclient","product":"Red Hat Process Automation 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6"],"defaultStatus":"unaffected","packageName":"candlepin","product":"Red Hat Satellite 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6"],"defaultStatus":"unaffected","packageName":"openvox-server","product":"Red Hat Satellite 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6"],"defaultStatus":"unaffected","packageName":"puppetserver","product":"Red Hat Satellite 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6"],"defaultStatus":"unaffected","packageName":"satellite:el8/candlepin","product":"Red Hat Satellite 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6"],"defaultStatus":"unaffected","packageName":"satellite:el8/puppetserver","product":"Red Hat Satellite 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"],"defaultStatus":"unaffected","packageName":"httpclient","product":"Red Hat Single Sign-On 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:amq_streams:2"],"defaultStatus":"unaffected","packageName":"httpclient","product":"streams for Apache Kafka 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:amq_streams:3"],"defaultStatus":"unaffected","packageName":"httpclient","product":"streams for Apache Kafka 3","vendor":"Red Hat"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:apache:httpclient:5.6:-:*:*:*:*:*:*","matchCriteriaId":"0E0B553E-826B-4260-80BD-3151F3FAFE07","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue."},{"lang":"es","value":"Paso crítico faltante en la autenticación en Apache HttpClient 5.6 permite a un atacante hacer que el cliente acepte la autenticación SCRAM-SHA-256 sin la verificación adecuada de autenticación mutua. Se recomienda a los usuarios actualizar a la versión 5.6.1, que soluciona este problema."}],"id":"CVE-2026-40542","lastModified":"2026-10-26T21:10:00.170","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.4,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-40542","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-22T14:14:52.319783Z","version":"2.0.3"}}]},"published":"2026-04-22T08:16:12.780","references":[{"source":"security@apache.org","tags":["Mailing List","Vendor Advisory"],"url":"https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"url":"http://www.openwall.com/lists/oss-security/2026/04/22/5"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:60239"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:60246"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:60247"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:60248"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:60249"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:60250"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:60251"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:60252"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:60254"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:60256"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:60259"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/security/cve/CVE-2026-40542"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2460518"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40542.json"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-304"}],"source":"security@apache.org","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-325"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]},"severity":"HIGH","source":"nvd","title":"Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCR..."}