CVE-2026-40542
Fixed in a distro release EPSS <1%CVSS 7.3
Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.
Products: Apache Software Foundation Apache HttpClient, Red Hat OpenShift Developer Tools and Services 4.12, Red Hat OpenShift Developer Tools and Services 4.13, Red Hat OpenShift Developer Tools and Services 4.14, Red Hat OpenShift Developer Tools and Services 4.15, Red Hat OpenShift Developer Tools and Services 4.16, Red Hat OpenShift Developer Tools and Services 4.17, Red Hat OpenShift Developer Tools and Services 4.18, Red Hat OpenShift Developer Tools and Services 4.19, Red Hat OpenShift Developer Tools and Services 4.20, Red Hat OpenShift Developer Tools and Services 4.21, Red Hat OpenShift Developer Tools and Services 4.22, Red Hat Cryostat 4, Red Hat Migration Toolkit for Applications 8, Red Hat OpenShift Developer Tools and Services, Red Hat OpenShift Serverless, Red Hat AMQ Broker 7, Red Hat AMQ Clients, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apache Camel for Spring Boot 4, Red Hat build of Apache Camel - HawtIO 4, Red Hat build of Apicurio Registry 2, Red Hat build of Apicurio Registry 3, Red Hat build of Debezium 3, Red Hat build of OptaPlanner 8, Red Hat build of Quarkus, Red Hat Certificate System 10, Red Hat Data Grid 8, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Fuse 7, Red Hat JBoss Core Services, Red Hat JBoss Enterprise Application Platform 7, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat JBoss Web Server 5, Red Hat JBoss Web Server 6, Red Hat Lightspeed for Runtimes Operator, Red Hat Offline Knowledge Portal, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Dev Spaces, Red Hat Process Automation 7, Red Hat Satellite 6, Red Hat Single Sign-On 7, Red Hat streams for Apache Kafka 2, Red Hat streams for Apache Kafka 3
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.apache.httpcomponents.client5:httpclient5 | 5.6.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | apache-nifi | 2.9.0-r7 |
| Chainguard | dependency-track | 4.14.1-r2 |
| Chainguard | dependency-track-apiserver | 4.14.1-r1 |
| Chainguard | dependency-track-bundled | 4.14.1-r2 |
| Chainguard | jbang | 0.139.3-r1 |
| Chainguard | opensearch-3 | 3.6.0-r2 |
| Chainguard | opensearch-3-alerting | 3.6.0-r2 |
| Chainguard | opensearch-3-anomaly-detection | 3.6.0-r2 |
| Chainguard | opensearch-3-cross-cluster-replication | 3.6.0-r2 |
| Chainguard | opensearch-3-k-nn | 3.6.0-r2 |
| Chainguard | opensearch-3-ml-commons | 3.6.0-r2 |
| Chainguard | opensearch-3-notifications | 3.6.0-r2 |
| Chainguard | opensearch-3-security | 3.6.0-r2 |
| Chainguard | opensearch-3-sql | 3.6.0-r2 |
| Chainguard | opensearch-fips-3 | 3.6.0-r2 |
| Chainguard | opensearch-fips-3-alerting | 3.6.0-r2 |
| Chainguard | opensearch-fips-3-anomaly-detection | 3.6.0-r2 |
| Chainguard | opensearch-fips-3-cross-cluster-replication | 3.6.0-r2 |
| Chainguard | opensearch-fips-3-k-nn | 3.6.0-r2 |
| Chainguard | opensearch-fips-3-ml-commons | 3.6.0-r2 |
| Chainguard | opensearch-fips-3-notifications | 3.6.0-r2 |
| Chainguard | opensearch-fips-3-security | 3.6.0-r2 |
| Chainguard | opensearch-fips-3-sql | 3.6.0-r2 |
| Chainguard | pinot | 1.5.0-r2 |
| Chainguard | pinot-fips | 1.5.0-r6 |
| Chainguard | trino-plugin-clickhouse | 481-r0 |
| Chainguard | trino-plugin-delta-lake | 481-r0 |
| Chainguard | trino-plugin-druid | 481-r0 |
| Chainguard | trino-plugin-hive | 481-r0 |
| Chainguard | trino-plugin-hudi | 481-r0 |
| Chainguard | trino-plugin-iceberg | 481-r0 |
| Chainguard | trino-plugin-kafka | 481-r0 |
| Chainguard | trino-plugin-lakehouse | 481-r0 |
| Chainguard | trino-plugin-openlineage | 481-r0 |
| Chainguard | trino-plugin-pinot | 481-r0 |
| Ubuntu 22.04 LTS | httpcomponents-client | no fix |
| Ubuntu 24.04 LTS | httpcomponents-client | no fix |
| Ubuntu 25.10 | httpcomponents-client | no fix |
| Ubuntu 26.04 LTS | httpcomponents-client | no fix |
| Ubuntu 26.10 | httpcomponents-client | no fix |
| Ubuntu Pro 14.04 LTS | httpcomponents-client | no fix |
| Ubuntu Pro 16.04 LTS | httpcomponents-client | no fix |
| Ubuntu Pro 18.04 LTS | httpcomponents-client | no fix |
| Ubuntu Pro 20.04 LTS | httpcomponents-client | no fix |
| Wolfi | apache-nifi | 2.9.0-r7 |
| Wolfi | dependency-track | 4.14.1-r2 |
| Wolfi | dependency-track-bundled | 4.14.1-r2 |
| Wolfi | opensearch-3 | 3.6.0-r2 |
| Wolfi | opensearch-3-alerting | 3.6.0-r2 |
| Wolfi | opensearch-3-anomaly-detection | 3.6.0-r2 |
| Wolfi | opensearch-3-cross-cluster-replication | 3.6.0-r2 |
| Wolfi | opensearch-3-k-nn | 3.6.0-r2 |
| Wolfi | opensearch-3-ml-commons | 3.6.0-r2 |
| Wolfi | opensearch-3-notifications | 3.6.0-r2 |
| Wolfi | opensearch-3-security | 3.6.0-r2 |
| Wolfi | opensearch-3-sql | 3.6.0-r2 |
| Wolfi | trino-plugin-clickhouse | 481-r0 |
| Wolfi | trino-plugin-delta-lake | 481-r0 |
| Wolfi | trino-plugin-druid | 481-r0 |
| Wolfi | trino-plugin-hive | 481-r0 |
| Wolfi | trino-plugin-hudi | 481-r0 |
| Wolfi | trino-plugin-iceberg | 481-r0 |
| Wolfi | trino-plugin-kafka | 481-r0 |
| Wolfi | trino-plugin-lakehouse | 481-r0 |
| Wolfi | trino-plugin-openlineage | 481-r0 |
| Wolfi | trino-plugin-pinot | 481-r0 |