ECHO-f0ba-e710-dc08
See a problem?- Import Source
- https://advisory.echohq.com/osv/ECHO-f0ba-e710-dc08.json
- JSON Data
- https://api.osv.dev/v1/vulns/ECHO-f0ba-e710-dc08
- Upstream
- Withdrawn
- 2026-11-05T09:28:04Z
- Published
- 2026-09-28T00:01:44Z
- Modified
- 2026-11-05T09:45:03Z
- Summary
- SCRAM-SHA-256 authentication accepted without verifying the server's final signature. The vendor advisory and GHSA list the affected range as >= 5.6-alpha1, < 5.6.1. ScramScheme, ScramSchemeFactory and ScramExtension were added by commit 5e73e17ae ("Add SCRAM-SHA-256 (RFC 7804) (#718)"), first released in 5.6-alpha1. At rel/v5.5.1 no httpclient5 main source mentions SCRAM (git grep -i scram finds nothing), so the vulnerable code does not exist. Trivy still flags 5.5.1.
- Details
- References