CVE-2026-40542

Katalog CVE

CVSS 7.3 · High EPSS 0,70%

Kerentanan Missing Critical Step in Authentication pada apache httpclient. Skor CVSS 3.1 7.3 (High) menurut CISA ADP.

Deskripsi (NVD)

Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.

Rincian

Terbit di NVD

22 April 2026

Terakhir diubah

9 September 2026

Status NVD

Modified

CVSS 3.1

7.3 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-304: Missing Critical Step in Authentication
CWE-325: Missing Cryptographic Step

EPSS (30 hari)

0,70% peluang dieksploitasi; lebih tinggi dari 52,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/tfmgv86xr0z1y096vs3z0y315t1v3o97 mailing list · advisory vendor
• http://www.openwall.com/lists/oss-security/2026/04/22/5 mailing list · advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2026:60239
• https://access.redhat.com/errata/RHSA-2026:60246
• https://access.redhat.com/errata/RHSA-2026:60247
• https://access.redhat.com/errata/RHSA-2026:60248
• https://access.redhat.com/errata/RHSA-2026:60249
• https://access.redhat.com/errata/RHSA-2026:60250
• https://access.redhat.com/errata/RHSA-2026:60251
• https://access.redhat.com/errata/RHSA-2026:60252
• https://access.redhat.com/errata/RHSA-2026:60254
• https://access.redhat.com/errata/RHSA-2026:60256
• https://access.redhat.com/errata/RHSA-2026:60259
• https://access.redhat.com/security/cve/CVE-2026-40542
• https://bugzilla.redhat.com/show_bug.cgi?id=2460518
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40542.json