CVE-2026-40542
Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.
Słabość
Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.
Produkty, których dotyczy
- apache httpclient
Źródła
- https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97
- http://www.openwall.com/lists/oss-security/2026/04/22/5
- https://access.redhat.com/errata/RHSA-2026:60239
- https://access.redhat.com/errata/RHSA-2026:60246
- https://access.redhat.com/errata/RHSA-2026:60247
- https://access.redhat.com/errata/RHSA-2026:60248
Znajdź błąd, zanim zrobi to atakujący.
Zaloguj się przez GitHub i uruchom pierwszy audyt w niecałą minutę. Plan darmowy nie wymaga karty kredytowej.