Apache Software Foundation Apache HttpClient

• CVE-2026-40542 High 7.3 Apache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to accept authentication without proper mutual authentication verification 0.5%