Is CVE-2026-40542 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40542 being exploited in the wild.

How severe is CVE-2026-40542?

High severity, with a CVSS score of 7.3, published 22 April 2026.

Which products and versions are affected?

org.apache.httpcomponents.client5:httpclient5 (Maven) ECOSYSTEM:introduced=5.6-alpha1,fixed=5.6.1.

Is there a fix for CVE-2026-40542?

Yes. org.apache.httpcomponents.client5:httpclient5 (Maven): upgrade to 5.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-40542 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-40542?

Check whether you run org.apache.httpcomponents.client5:httpclient5 (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40542: Apache HttpClient authentication bypass in SCRAM-SHA-256

CVE-2026-40542 · Severity: high · CVSS 7.3 · Published 2026-04-22

Apache HttpClient, a widely used Java library for handling web requests, contains a security flaw in its authentication process. An attacker could trick the client into accepting a connection without verifying the identity of the server, potentially leading to unauthorized data access or communication with a malicious server. Organizations using version 5.6 should upgrade to version 5.6.1 to ensure secure mutual authentication.

Technologies: org.apache.httpcomponents.client5:httpclient5 (Maven). Vendors: Maven.

Quick answers

Is CVE-2026-40542 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40542 being exploited in the wild.
How severe is CVE-2026-40542?: High severity, with a CVSS score of 7.3, published 22 April 2026.
Which products and versions are affected?: org.apache.httpcomponents.client5:httpclient5 (Maven) ECOSYSTEM:introduced=5.6-alpha1,fixed=5.6.1.
Is there a fix for CVE-2026-40542?: Yes. org.apache.httpcomponents.client5:httpclient5 (Maven): upgrade to 5.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40542 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-40542?: Check whether you run org.apache.httpcomponents.client5:httpclient5 (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.apache.httpcomponents.client5:httpclient5 (Maven): upgrade to 5.6.1 or later

# set org.apache.httpcomponents.client5:httpclient5 to 5.6.1 in your pom.xml or build.gradle

Technical details

A vulnerability exists in Apache HttpClient 5.6 due to a missing critical step in the SCRAM-SHA-256 authentication mechanism (CWE-304, CWE-325). The flaw allows a remote attacker to cause the client to accept authentication without proper mutual verification of the server's identity. This effectively results in an authentication bypass where the client fails to validate the server's response during the SCRAM handshake. The issue is reachable over the network without prior authentication or user interaction. A fix is available in version 5.6.1.

Affected products

Apache Software Foundation HttpClient 5.6

Identifiers

CVE-2026-40542
GHSA-v468-qcjx-r72w

Timeline

2026-04-22: disclosed
2026-04-22: advisory
2026-04-22: patched: Fixed in version 5.6.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.