Executive brief
Apache HttpClient, a widely used Java library for handling web requests, contains a security flaw in its authentication process. An attacker could trick the client into accepting a connection without verifying the identity of the server, potentially leading to unauthorized data access or communication with a malicious server. Organizations using version 5.6 should upgrade to version 5.6.1 to ensure secure mutual authentication.
Technical details
A vulnerability exists in Apache HttpClient 5.6 due to a missing critical step in the SCRAM-SHA-256 authentication mechanism (CWE-304, CWE-325). The flaw allows a remote attacker to cause the client to accept authentication without proper mutual verification of the server's identity. This effectively results in an authentication bypass where the client fails to validate the server's response during the SCRAM handshake. The issue is reachable over the network without prior authentication or user interaction. A fix is available in version 5.6.1.
Affected products
- Apache Software Foundation HttpClient 5.6
Timeline
- 2026-04-22: disclosed
- 2026-04-22: advisory
- 2026-04-22: patched: Fixed in version 5.6.1
References
- https://repo.maven.apache.org/maven2
- https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97
- http://www.openwall.com/lists/oss-security/2026/04/22/5
- https://access.redhat.com/security/cve/CVE-2026-40542
- https://bugzilla.redhat.com/show_bug.cgi?id=2460518
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40542.json