{
  "from_raw": "Lenny Primak <lprimak@apache.org>",
  "from": "Lenny Primak <lp...@apache.org>",
  "gravatar": "3412c78813a07ca863c82de7fc207fd7",
  "to": "an...@apache.org,\n de...@shiro.apache.org",
  "subject": "CVE-2026-43828: Apache Shiro: Shiro's native session and rememberMe cookies do not have secure flag set by default",
  "message-id": "<f0c4d086-8d49-b355-5040-be856310277e@apache.org>",
  "mid": "xsk65m89shdtv4nhmfp7jrokc5wwlvpk",
  "permalinks": [
    "xsk65m89shdtv4nhmfp7jrokc5wwlvpk",
    "r044461f8ff8ebb5ebbd981db58e1b62558c7825d2182322b0ddb4a2b@<announce.apache.org>"
  ],
  "dbid": "87ffed45f690fd014ff4b72aabb2c4a015a3e86a43228c22c3cf82452c031379",
  "cc": "de...@shiro.apache.org",
  "epoch": 1779738645,
  "list": "<announce.apache.org>",
  "list_raw": "<announce.apache.org>",
  "date": "2026/05/25 19:50:45",
  "private": false,
  "references": "",
  "in-reply-to": "",
  "body": "Severity: \n\nAffected versions:\n\n- Apache Shiro (org.apache.shiro:shiro-web) 1.0 through 2.1.0\n- Apache Shiro (org.apache.shiro:shiro-web) 3.0.0-alpha-0 through 3.0.0-alpha-1\n\nDescription:\n\nDefault configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute.\n\n\n\nThis issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1.\n\nUsers are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue.\n\nIn the affected versions, Shiro-native session manager, as well as Remember-Me manager sends JSESSIONID and rememberMe cookies without 'secure' attribute by default.\n\nCredit:\n\nMeteor_Kai <13...@qq.com> (finder)\nLenny Primak <le...@flowlogix.com> (remediation developer)\n\nReferences:\n\nhttps://shiro.apache.org/\nhttps://www.cve.org/CVERecord?id=CVE-2026-43828\n\n",
  "body_short": "Severity: \n\nAffected versions:\n\n- Apache Shiro (org.apache.shiro:shiro-web) 1.0 through 2.1.0\n- Apache Shiro (org.apache.shiro:shiro-web) 3.0.0-alpha-0 through 3.0.0-alpha-1\n\nDescription:\n\nDefault conf",
  "html_source_only": false,
  "attachments": [],
  "forum": "announce@apache.org",
  "size": 2812,
  "id": "xsk65m89shdtv4nhmfp7jrokc5wwlvpk"
}