RHLW-2026-2a7b95611000d6b5

See a problem?
Please try reporting it to the source first.
Source
https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-2a7b95611000d6b5.json
Import Source
https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-2a7b95611000d6b5.json
JSON Data
https://api.test.osv.dev/v1/vulns/RHLW-2026-2a7b95611000d6b5
Upstream
CVE (2)
GHSA (2)
Published
2026-10-12T16:58:44Z
Modified
2026-10-22T00:08:22Z
Severity
  • 7.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
Summary
Lightwell Security Advisory: httpclient5 5.6.0.rhlw-00001
Details

Red Hat Lightwell has released org.apache.httpcomponents.client5:httpclient5 5.6.0.rhlw-00001 with backported fixes for CVE-2026-40542 and CVE-2026-64607.

CVE-2026-40542: Apache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to accept authentication without proper mutual authentication verification

CVE-2026-64607: Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS

This patched artifact is a drop-in replacement for org.apache.httpcomponents.client5:httpclient5 5.6.0 from Maven Central.

References
Credits
    • Red Hat Lightwell - REMEDIATION_DEVELOPER

Affected packages

Red Hat Lightwell:Maven / org.apache.httpcomponents.client5:httpclient5

Package

Name
org.apache.httpcomponents.client5:httpclient5
Purl
pkg:maven/org.apache.httpcomponents.client5/httpclient5

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
5.6.0.rhlw-00001

Affected versions

5.*
5.0-alpha1
5.0-alpha2
5.0-alpha3
5.0-beta1
5.0-beta2
5.0-beta3
5.0-beta4
5.0-beta5
5.0-beta6
5.0-beta7
5.0
5.0.1
5.0.2
5.0.3
5.0.4
5.1-beta1
5.1
5.1.1
5.1.2
5.1.3
5.1.4
5.2-alpha1
5.2-beta1
5.2
5.2.1
5.2.2
5.2.3
5.3-alpha1
5.3
5.3.1
5.4-alpha1
5.4-alpha2
5.4-beta1
5.4
5.4.1
5.4.2
5.4.3
5.4.4
5.5-alpha1
5.5
5.5.1
5.5.2
5.6-alpha1
5.6
5.6.0

Database specific

lightwell 
{
    "backport_base_version": "5.6.0",
    "remediated_version": "5.6.0.rhlw-00001",
    "repository_url": "https://packages.redhat.com/lightwell/java/remediated/"
}
source 
"https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-2a7b95611000d6b5.json"