Read the docs
TI-2026-29288 Aliases CVE-2026-40542GHSA-v468-qcjx-r72w

Apache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to…

Priority LOW 39CWE-304Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Partial Red Hat: 11 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat.

Summary

Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00536 45th percentileScored 2026-11-07
Fix Partial Apache HttpClient (Apache Software Foundation): 5.6.1org.apache.httpcomponents.client5:httpclient5 (Maven): 5.6.1Red Hat: 11 advisoriesRed Hat: 11 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache HttpClient5.6 to before 5.6.15.6.1Patch availableCNA
—org.apache.httpcomponents.client5:httpclient5 (Maven)5.6-alpha1 to before 5.6.15.6.1Patch availableGHSA-v468-qcjx-r72w
  • Apache HttpClient VendorApache Affected 5.6 to before 5.6.1 Fixed in 5.6.1 Patch available CNA
  • org.apache.httpcomponents.client5:httpclient5 (Maven) Vendor— Affected 5.6-alpha1 to before 5.6.1 Fixed in 5.6.1 Patch available GHSA-v468-qcjx-r72w

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:httpclient:5.6:-:*:*:*:*:*:*5.6VulnerableApache
  • cpe:2.3:a:apache:httpclient:5.6:-:*:*:*:*:*:* Versions 5.6 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache HttpClient (Apache Software Foundation) Fixed in 5.6.1
  • Fix · GHSA-v468-qcjx-r72w org.apache.httpcomponents.client5:httpclient5 (Maven) Fixed in 5.6.1 Advisory →

Red Hat 11 advisories

  • RHSA-2026:60259 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.20 security update.
    • OpenShift Developer Tools and Services 4.20 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60256 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.22 security update.
    • OpenShift Developer Tools and Services 4.22 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60254 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.21 security update.
    • OpenShift Developer Tools and Services 4.21 registry.redhat.io/ocp-tools-4/jenkins-rhel9
Show 8 more Red Hat advisories
  • RHSA-2026:60252 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.19 security update.
    • OpenShift Developer Tools and Services 4.19 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60251 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.16 security update.
    • OpenShift Developer Tools and Services 4.16 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60250 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.18 security update.
    • OpenShift Developer Tools and Services 4.18 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60249 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.13 security update.
    • OpenShift Developer Tools and Services 4.13 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:60248 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.14 security update.
    • OpenShift Developer Tools and Services 4.14 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:60247 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.12 security update.
    • OpenShift Developer Tools and Services 4.12 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:60246 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.17 security update.
    • OpenShift Developer Tools and Services 4.17 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60239 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.15 security update.
    • OpenShift Developer Tools and Services 4.15 registry.redhat.io/ocp-tools-4/jenkins-rhel8

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Developer Tools and ServicesAffectedNo fix yet
OpenShift Developer Tools and Services 4.12Fixed RHSA-2026:60247
OpenShift Developer Tools and Services 4.13Fixed RHSA-2026:60249
OpenShift Developer Tools and Services 4.14Fixed RHSA-2026:60248
OpenShift Developer Tools and Services 4.15Fixed RHSA-2026:60239
OpenShift Developer Tools and Services 4.16Fixed RHSA-2026:60251
OpenShift Developer Tools and Services 4.17Fixed RHSA-2026:60246
OpenShift Developer Tools and Services 4.18Fixed RHSA-2026:60250
OpenShift Developer Tools and Services 4.19Fixed RHSA-2026:60252
OpenShift Developer Tools and Services 4.20Fixed RHSA-2026:60259
OpenShift Developer Tools and Services 4.21Fixed RHSA-2026:60254
OpenShift Developer Tools and Services 4.22Fixed RHSA-2026:60256
Not affected: 46 products
  • Cryostat 4
  • Migration Toolkit for Applications 8
  • OpenShift Developer Tools and Services 4.12
  • OpenShift Developer Tools and Services 4.13
  • OpenShift Developer Tools and Services 4.14
  • OpenShift Developer Tools and Services 4.15
  • OpenShift Developer Tools and Services 4.16
  • OpenShift Developer Tools and Services 4.17
  • OpenShift Developer Tools and Services 4.18
  • OpenShift Developer Tools and Services 4.19
  • OpenShift Developer Tools and Services 4.20
  • OpenShift Developer Tools and Services 4.21
  • OpenShift Developer Tools and Services 4.22
  • OpenShift Serverless
  • Red Hat AMQ Broker 7
  • Red Hat AMQ Clients
  • Red Hat Certificate System 10
  • Red Hat Data Grid 8
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Fuse 7
  • Red Hat JBoss Core Services
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat JBoss Web Server 5
  • Red Hat JBoss Web Server 6
  • Red Hat Lightspeed for Runtimes Operator
  • Red Hat Offline Knowledge Portal
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift Dev Spaces
  • Red Hat Process Automation 7
  • Red Hat Satellite 6
  • Red Hat Single Sign-On 7
  • Red Hat build of Apache Camel - HawtIO 4
  • Red Hat build of Apache Camel 4 for Quarkus 3
  • Red Hat build of Apache Camel for Spring Boot 4
  • Red Hat build of Apicurio Registry 2
  • Red Hat build of Apicurio Registry 3
  • Red Hat build of Debezium 3
  • Red Hat build of OptaPlanner 8
  • Red Hat build of Quarkus
  • streams for Apache Kafka 2
  • streams for Apache Kafka 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40542
  2. 2026-10-03 Alias added: GHSA-v468-qcjx-r72w
  3. 2026-10-25 EPSS moved to the below the 50th percentile

References

Advisory 3

Other 2

  • TI-2013-03825 http/impl/client/HttpClientBuilder.java in Apache HttpClient 4.3.x before 4.3.1 does not… CVSS 3.1CRITICAL 9.8
  • TI-2026-49957 Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM) CVSS 3.1CRITICAL 9.1
  • TI-2020-10932 Improper input validation in Apache HttpClient CVSS 3.1MEDIUM 5.3
  • TI-2025-20592 Apache HttpComponents: PSL (Public Suffix List) validation bypass CVSS 3.1HIGH 7.5
  • TI-2015-04421 http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before… CVSS 2.0MEDIUM 4.3
  • TI-2014-02901 org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before… CVSS 2.0MEDIUM 5.8
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences