This is an automated email from the ASF dual-hosted git repository.
lprimak pushed a commit to branch asf-site
in repository https://gitbox.apache.org/repos/asf/shiro-site.git
The following commit(s) were added to refs/heads/asf-site by this push:
new e144ad144 update CVEs May 23 2026
e144ad144 is described below
commit e144ad144e91f5d904305561cedd5ed406eda1ce
Author: lprimak <[email protected]>
AuthorDate: Sat May 23 21:46:30 2026 -0500
update CVEs May 23 2026
---
.well-known/security.txt | 2 +-
feed.xml | 2 +-
security-reports.html | 33 +++++++++++++++++++++++++--------
3 files changed, 27 insertions(+), 10 deletions(-)
diff --git a/.well-known/security.txt b/.well-known/security.txt
index bcf78db84..b4c416ff5 100644
--- a/.well-known/security.txt
+++ b/.well-known/security.txt
@@ -1,5 +1,5 @@
Contact: mailto:[email protected]
-Expires: 2027-05-21T09:12:00Z
+Expires: 2027-05-24T02:46:12Z
Preferred-Languages: en
Canonical: https://shiro.apache.org/.well-known/security.txt
Policy: https://shiro.apache.org/security-reports.html
\ No newline at end of file
diff --git a/feed.xml b/feed.xml
index d40781469..49bc3dfa1 100644
--- a/feed.xml
+++ b/feed.xml
@@ -4,7 +4,7 @@
<subtitle>Simple. Java. Security.</subtitle>
<link href="https://shiro.apache.org/"/>
<link rel="self" href="https://shiro.apache.org/feed.xml"; />
- <updated>2026-05-21T09:12:00Z</updated>
+ <updated>2026-05-24T02:46:12Z</updated>
<author>
<name>Les Hazlewood</name>
diff --git a/security-reports.html b/security-reports.html
index 2b0df5d4d..831971726 100644
--- a/security-reports.html
+++ b/security-reports.html
@@ -232,6 +232,7 @@
<li><a href="#vulnerability_handling_process">Vulnerability Handling
Process</a></li>
<li><a href="#apache_shiro_vulnerability_reports">Apache Shiro Vulnerability
Reports</a>
<ul class="sectlevel2">
+<li><a href="#cve_2026_48589">CVE-2026-48589</a></li>
<li><a href="#cve_2026_44598">CVE-2026-44598</a></li>
<li><a href="#cve_2026_43827">CVE-2026-43827</a></li>
<li><a href="#cve_2026_43828">CVE-2026-43828</a></li>
@@ -304,14 +305,30 @@ We cannot accept regular bug reports or other queries at
this address.</p>
<h2 id="apache_shiro_vulnerability_reports">Apache Shiro Vulnerability
Reports</h2>
<div class="sectionbody">
<div class="sect2">
+<h3 id="cve_2026_48589"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-48589";>CVE-2026-48589</a></h3>
+<div class="paragraph">
+<p>Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain
cases to issue redirect after a user login. In affected versions, insufficient
validation of this client-controlled value could allow an attacker to influence
the redirect target in applications using the Jakarta EE module.
+This issue affects Apache Shiro from 2.0-alpha to 2.2.0, and 3.0.0-alpha-1,
only when using shiro-jakarta-ee integration module.</p>
+</div>
+<div class="paragraph">
+<p><strong>Mitigation:</strong>
+Upgrade to version 2.2.1, or 3.0.0-alpha-2 or later, which fixes the issue by
validating the Referer header and restricting redirects only to relative paths
within the current application context.</p>
+</div>
+<div class="paragraph">
+<p><strong>Credit:</strong>
+Apache Shiro would like to thank <strong>Bartlomiej Dmitruk</strong> for
reporting this issue.</p>
+</div>
+</div>
+<div class="sect2">
<h3 id="cve_2026_44598"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-44598";>CVE-2026-44598</a></h3>
<div class="paragraph">
-<p>With valid login credentials, URL Redirection to Untrusted Site ('Open
Redirect'), Server-Side Request Forgery (SSRF) vulnerability in Apache Shiro.
This issue affects Apache Shiro from 2.0-alpha to 2.1.0, and 3.0.0-alpha-1,
only when using shiro-jakarta-ee integration module. Users are recommended to
upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue by
encrypting the cookie.
-After successful login, Jakarta EE integration module uses shiroSavedRequest
cookie to redirect to a particular web page after login. This cookie was not
validated, and can be forged to send an HTTP GET request from the server itself
to an arbitrary URL from the cookie.</p>
+<p>With valid login credentials, URL Redirection to Untrusted Site ('Open
Redirect'), Server-Side Request Forgery (SSRF) vulnerability in Apache Shiro.
+After successful login, Jakarta EE integration module uses shiroSavedRequest
cookie to redirect to a particular web page after login. This cookie was not
validated, and can be forged to send an HTTP GET request from the server itself
to an arbitrary URL from the cookie.
+This issue affects Apache Shiro from 2.0-alpha to 2.1.0, and 3.0.0-alpha-1,
only when using shiro-jakarta-ee integration module.</p>
</div>
<div class="paragraph">
<p><strong>Mitigation:</strong>
-Upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue by
encrypting the cookie.</p>
+Upgrade to version 2.2.0, or 3.0.0-alpha-2 or later, which fixes the issue by
encrypting the cookie.</p>
</div>
<div class="paragraph">
<p><strong>Credit:</strong>
@@ -321,11 +338,11 @@ Apache Shiro would like to thank <strong>James
Love</strong> for reporting this
<div class="sect2">
<h3 id="cve_2026_43827"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-43827";>CVE-2026-43827</a></h3>
<div class="paragraph">
-<p>Default configurations of Apache Shiro have a session fixation
vulnerability. This issue affects Apache Shiro from 1.0 to 2.1.0, and
3.0.0-alpha-1. Users are recommended to upgrade to version 2.1.1, 3.0.0-alpha-2
or later, which fixes the issue. In the affected versions, when a session
already exists, it is not invalidated upon successful login, nor is a new
session being generated with a new ID.</p>
+<p>Default configurations of Apache Shiro have a session fixation
vulnerability. This issue affects Apache Shiro from 1.0 to 2.1.0, and
3.0.0-alpha-1. In the affected versions, when a session already exists, it is
not invalidated upon successful login, nor is a new session being generated
with a new ID.</p>
</div>
<div class="paragraph">
<p><strong>Mitigation:</strong>
-Upgrade to version 2.1.1, 3.0.0-alpha-2 or later, which fixes the issue.</p>
+Upgrade to version 2.2.0, 3.0.0-alpha-2 or later, which fixes the issue by
invalidating the existing session and creating a new session with a new ID upon
successful login.</p>
</div>
<div class="paragraph">
<p><strong>Credit:</strong>
@@ -335,12 +352,12 @@ Apache Shiro would like to thank <strong>Rasmus
Moorats</strong> for reporting t
<div class="sect2">
<h3 id="cve_2026_43828"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-43828";>CVE-2026-43828</a></h3>
<div class="paragraph">
-<p>Default configurations of Apache Shiro send sensitive cookies in HTTPS
session without 'Secure' attribute. This issue affects Apache Shiro from 1.0 to
2.1.0, and 3.0.0-alpha-1. Users are recommended to upgrade to version 2.1.1, or
3.0.0-alpha-2 or later, which fixes the issue.<br>
+<p>Default configurations of Apache Shiro send sensitive cookies in HTTPS
session without 'Secure' attribute. This issue affects Apache Shiro from 1.0 to
2.1.0, and 3.0.0-alpha-1.
In the affected versions, Shiro-native session manager, as well as Remember-Me
manager sends JSESSIONID and rememberMe cookies without <code>secure</code>
attribute by default.</p>
</div>
<div class="paragraph">
<p><strong>Mitigation:</strong>
-Upgrade to version 2.1.1, 3.0.0-alpha-2 or later, which fixes the issue.</p>
+Upgrade to version 2.2.0, 3.0.0-alpha-2 or later, which fixes the issue by
setting the <code>secure</code> attribute.</p>
</div>
<div class="paragraph">
<p><strong>Credit:</strong>
@@ -353,7 +370,7 @@ Apache Shiro would like to thank
<strong>Meteor_Kai</strong> for reporting this
<p>If static files are served from a case-insensitive filesystem,
such as default macOS setup, static files may be accessed by varying the case
of the filename in the request.
If only lower-case (common default) filters are present in Shiro, they may be
bypassed this way.
-The issue only effects static files.</p>
+The issue only affects static files.</p>
</div>
<div class="paragraph">
<p>Shiro 2.1.0 and later has a new parameters to remediate this issue
