You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@shiro.apache.org by lp...@apache.org on 2026/06/24 18:28:41 UTC
(shiro-site) branch asf-site updated: updated security reports
This is an automated email from the ASF dual-hosted git repository.
lprimak pushed a commit to branch asf-site
in repository https://gitbox.apache.org/repos/asf/shiro-site.git
The following commit(s) were added to refs/heads/asf-site by this push:
new f9edc17c1 updated security reports
f9edc17c1 is described below
commit f9edc17c1b541bb7d21f89ab227f14e54a2fec4d
Author: lprimak <le...@flowlogix.com>
AuthorDate: Wed Jun 24 13:28:25 2026 -0500
updated security reports
---
.well-known/security.txt | 2 +-
feed.xml | 2 +-
security-reports.html | 33 +++++++++++++++++++++++++++++++++
3 files changed, 35 insertions(+), 2 deletions(-)
diff --git a/.well-known/security.txt b/.well-known/security.txt
index 3dd21caed..61e68fa4f 100644
--- a/.well-known/security.txt
+++ b/.well-known/security.txt
@@ -1,5 +1,5 @@
Contact: mailto:security@shiro.apache.org
-Expires: 2027-06-18T17:02:24Z
+Expires: 2027-06-24T18:27:56Z
Preferred-Languages: en
Canonical: https://shiro.apache.org/.well-known/security.txt
Policy: https://shiro.apache.org/security-reports.html
\ No newline at end of file
diff --git a/feed.xml b/feed.xml
index 64bf3cce7..a7d04d5ac 100644
--- a/feed.xml
+++ b/feed.xml
@@ -4,7 +4,7 @@
<subtitle>Simple. Java. Security.</subtitle>
<link href="https://shiro.apache.org/"/>
<link rel="self" href="https://shiro.apache.org/feed.xml" />
- <updated>2026-06-18T17:02:25Z</updated>
+ <updated>2026-06-24T18:27:57Z</updated>
<author>
<name>Les Hazlewood</name>
diff --git a/security-reports.html b/security-reports.html
index 35a0a79ce..6ff8fd540 100644
--- a/security-reports.html
+++ b/security-reports.html
@@ -232,7 +232,9 @@
<li><a href="#vulnerability_handling_process">Vulnerability Handling Process</a></li>
<li><a href="#apache_shiro_vulnerability_reports">Apache Shiro Vulnerability Reports</a>
<ul class="sectlevel2">
+<li><a href="#cve_2026_56091">CVE-2026-56091</a></li>
<li><a href="#cve_2026_49268">CVE-2026-49268</a></li>
+<li><a href="#cve_2026_49268_2">CVE-2026-49268</a></li>
<li><a href="#cve_2026_48589">CVE-2026-48589</a></li>
<li><a href="#cve_2026_44598">CVE-2026-44598</a></li>
<li><a href="#cve_2026_43827">CVE-2026-43827</a></li>
@@ -306,8 +308,39 @@ We cannot accept regular bug reports or other queries at this address.</p>
<h2 id="apache_shiro_vulnerability_reports">Apache Shiro Vulnerability Reports</h2>
<div class="sectionbody">
<div class="sect2">
+<h3 id="cve_2026_56091"><a href="https://www.cve.org/CVERecord?id=CVE-2026-56091">CVE-2026-56091</a></h3>
+<div class="paragraph">
+<p>When using Apache Shiro with the <code>shiro-guice</code> module in a web servlet context, a specially crafted HTTP request may cause an authentication bypass.
+This vulnerability is similar to <a href="https://www.cve.org/CVERecord?id=CVE-2020-1957">CVE-2020-1957</a>, except that it affects the <code>shiro-guice</code> module instead of the <code>shiro-spring</code> module.
+This issue affects all Apache Shiro versions through 2.x, and 3.0.0-alpha-1 only when using <code>shiro-guice</code> module in a web servlet context.</p>
+</div>
+<div class="paragraph">
+<p><strong>Mitigation:</strong>
+Upgrade to version 3.0.0 or later, which fixes the issue.</p>
+</div>
+<div class="paragraph">
+<p><strong>Credit:</strong>
+Apache Shiro would like to thank <strong>LocalHost</strong> for reporting this issue.</p>
+</div>
+</div>
+<div class="sect2">
<h3 id="cve_2026_49268"><a href="https://www.cve.org/CVERecord?id=CVE-2026-49268">CVE-2026-49268</a></h3>
<div class="paragraph">
+<p>"Remember me" cookie age is not verified on the server. This potentially allows an attacker to intercept a valid cookie and reuse it indefinitely, even after the configured expiration time has passed.
+This issue affects all Apache Shiro versions from 1.2.4 through 2.x, and 3.0.0-alpha-1, only when RememberMe functionality is enabled.</p>
+</div>
+<div class="paragraph">
+<p><strong>Mitigation:</strong>
+Upgrade to version 3.0.0 or later, which fixes the issue.</p>
+</div>
+<div class="paragraph">
+<p><strong>Credit:</strong>
+Apache Shiro would like to thank <strong>Richard Bradley</strong> for reporting this issue.</p>
+</div>
+</div>
+<div class="sect2">
+<h3 id="cve_2026_49268_2"><a href="https://www.cve.org/CVERecord?id=CVE-2026-49268">CVE-2026-49268</a></h3>
+<div class="paragraph">
<p>A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in <code>DefaultLdapRealm</code> class. User-supplied username input is directly concatenated into the LDAP DN template without any escaping of RFC 2253 special characters. This allows an attacker to manipulate the DN structure used for LDAP bind authentication, potentially bypassing authentication or impersonating other users.
This issue affects all Apache Shiro versions through 2.2.0, and 3.0.0-alpha-1 when using <code>DefaultLdapRealm</code>.</p>
</div>