Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to
    accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are
    recommended to upgrade to version 5.6.1, which fixes this issue. (CVE-2026-40542)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to     accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are     recommended to upgrade to version 5.6.1, which fixes this issue. (CVE-2026-40542)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
441020	SCA: security update for org.apache.httpcomponents.client5:httpclient5 (GHSA-v468-qcjx-r72w)	Tenable Cloud Security	SCA Checks	high
441020	SCA: security update for org.apache.httpcomponents.client5:httpclient5 (GHSA-v468-qcjx-r72w)	Tenable Self-Hosted Container Security	SCA Checks	high
310832	Linux Distros Unpatched Vulnerability : CVE-2026-40542	Nessus	Misc.	high

Detections

Analytics

CVE-2026-40542

high

Tenable Plugins

high

high

high