Към съдържанието
Търсене

CVE-2026-40542: Apache Software Foundation Apache HttpClient

7.3

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, без особени условия, без вход и без действие от потребителя.

CVE радар: още уязвимости от този вид

  • Експлоатация: няма данни за експлоатация
  • Атаката може да се автоматизира

Описание

Оригинално описание

Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.

Засегнати продукти

  • Apache Software Foundation Apache HttpClient: 5.6 преди 5.6.1
  • Red Hat: още 47 продукта, добавени от Red Hat

    OpenShift Developer Tools and Services 4.12, OpenShift Developer Tools and Services 4.13, OpenShift Developer Tools and Services 4.14, OpenShift Developer Tools and Services 4.15, OpenShift Developer Tools and Services 4.16, OpenShift Developer Tools and Services 4.17, OpenShift Developer Tools and Services 4.18, OpenShift Developer Tools and Services 4.19, OpenShift Developer Tools and Services 4.20, OpenShift Developer Tools and Services 4.21, OpenShift Developer Tools and Services 4.22, Cryostat 4, Migration Toolkit for Applications 8, OpenShift Developer Tools and Services, OpenShift Serverless, Red Hat AMQ Broker 7, Red Hat AMQ Clients, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apache Camel for Spring Boot 4, Red Hat build of Apache Camel - HawtIO 4, Red Hat build of Apicurio Registry 2, Red Hat build of Apicurio Registry 3, Red Hat build of Debezium 3, Red Hat build of OptaPlanner 8, Red Hat build of Quarkus, Red Hat Certificate System 10, Red Hat Data Grid 8, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Fuse 7, Red Hat JBoss Core Services, Red Hat JBoss Enterprise Application Platform 7, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat JBoss Web Server 5, Red Hat JBoss Web Server 6, Red Hat Lightspeed for Runtimes Operator, Red Hat Offline Knowledge Portal, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Dev Spaces, Red Hat Process Automation 7, Red Hat Satellite 6, Red Hat Single Sign-On 7, streams for Apache Kafka 2, streams for Apache Kafka 3

Вид слабост

История

  • 22 април 2026 Публикувано

Други уязвимости в Apache Software Foundation Apache HttpClient

Първоизточници

CVE-2026-40542: Apache Software Foundation Apache HttpClient | freedomonline.bg