This is an automated email from the ASF dual-hosted git repository.
lprimak pushed a commit to branch asf-site
in repository https://gitbox.apache.org/repos/asf/shiro-site.git
The following commit(s) were added to refs/heads/asf-site by this push:
new f9edc17c1 updated security reports
f9edc17c1 is described below
commit f9edc17c1b541bb7d21f89ab227f14e54a2fec4d
Author: lprimak <[email protected]>
AuthorDate: Wed Jun 24 13:28:25 2026 -0500
updated security reports
---
.well-known/security.txt | 2 +-
feed.xml | 2 +-
security-reports.html | 33 +++++++++++++++++++++++++++++++++
3 files changed, 35 insertions(+), 2 deletions(-)
diff --git a/.well-known/security.txt b/.well-known/security.txt
index 3dd21caed..61e68fa4f 100644
--- a/.well-known/security.txt
+++ b/.well-known/security.txt
@@ -1,5 +1,5 @@
Contact: mailto:[email protected]
-Expires: 2027-06-18T17:02:24Z
+Expires: 2027-06-24T18:27:56Z
Preferred-Languages: en
Canonical: https://shiro.apache.org/.well-known/security.txt
Policy: https://shiro.apache.org/security-reports.html
\ No newline at end of file
diff --git a/feed.xml b/feed.xml
index 64bf3cce7..a7d04d5ac 100644
--- a/feed.xml
+++ b/feed.xml
@@ -4,7 +4,7 @@
<subtitle>Simple. Java. Security.</subtitle>
<link href="https://shiro.apache.org/"/>
<link rel="self" href="https://shiro.apache.org/feed.xml"; />
- <updated>2026-06-18T17:02:25Z</updated>
+ <updated>2026-06-24T18:27:57Z</updated>
<author>
<name>Les Hazlewood</name>
diff --git a/security-reports.html b/security-reports.html
index 35a0a79ce..6ff8fd540 100644
--- a/security-reports.html
+++ b/security-reports.html
@@ -232,7 +232,9 @@
<li><a href="#vulnerability_handling_process">Vulnerability Handling
Process</a></li>
<li><a href="#apache_shiro_vulnerability_reports">Apache Shiro Vulnerability
Reports</a>
<ul class="sectlevel2">
+<li><a href="#cve_2026_56091">CVE-2026-56091</a></li>
<li><a href="#cve_2026_49268">CVE-2026-49268</a></li>
+<li><a href="#cve_2026_49268_2">CVE-2026-49268</a></li>
<li><a href="#cve_2026_48589">CVE-2026-48589</a></li>
<li><a href="#cve_2026_44598">CVE-2026-44598</a></li>
<li><a href="#cve_2026_43827">CVE-2026-43827</a></li>
@@ -306,8 +308,39 @@ We cannot accept regular bug reports or other queries at
this address.</p>
<h2 id="apache_shiro_vulnerability_reports">Apache Shiro Vulnerability
Reports</h2>
<div class="sectionbody">
<div class="sect2">
+<h3 id="cve_2026_56091"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-56091";>CVE-2026-56091</a></h3>
+<div class="paragraph">
+<p>When using Apache Shiro with the <code>shiro-guice</code> module in a web
servlet context, a specially crafted HTTP request may cause an authentication
bypass.
+This vulnerability is similar to <a
href="https://www.cve.org/CVERecord?id=CVE-2020-1957";>CVE-2020-1957</a>, except
that it affects the <code>shiro-guice</code> module instead of the
<code>shiro-spring</code> module.
+This issue affects all Apache Shiro versions through 2.x, and 3.0.0-alpha-1
only when using <code>shiro-guice</code> module in a web servlet context.</p>
+</div>
+<div class="paragraph">
+<p><strong>Mitigation:</strong>
+Upgrade to version 3.0.0 or later, which fixes the issue.</p>
+</div>
+<div class="paragraph">
+<p><strong>Credit:</strong>
+Apache Shiro would like to thank <strong>LocalHost</strong> for reporting this
issue.</p>
+</div>
+</div>
+<div class="sect2">
<h3 id="cve_2026_49268"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-49268";>CVE-2026-49268</a></h3>
<div class="paragraph">
+<p>"Remember me" cookie age is not verified on the server. This potentially
allows an attacker to intercept a valid cookie and reuse it indefinitely, even
after the configured expiration time has passed.
+This issue affects all Apache Shiro versions from 1.2.4 through 2.x, and
3.0.0-alpha-1, only when RememberMe functionality is enabled.</p>
+</div>
+<div class="paragraph">
+<p><strong>Mitigation:</strong>
+Upgrade to version 3.0.0 or later, which fixes the issue.</p>
+</div>
+<div class="paragraph">
+<p><strong>Credit:</strong>
+Apache Shiro would like to thank <strong>Richard Bradley</strong> for
reporting this issue.</p>
+</div>
+</div>
+<div class="sect2">
+<h3 id="cve_2026_49268_2"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-49268";>CVE-2026-49268</a></h3>
+<div class="paragraph">
<p>A remote attacker can inject LDAP special characters into the Distinguished
Name (DN) construction in <code>DefaultLdapRealm</code> class. User-supplied
username input is directly concatenated into the LDAP DN template without any
escaping of RFC 2253 special characters. This allows an attacker to manipulate
the DN structure used for LDAP bind authentication, potentially bypassing
authentication or impersonating other users.
This issue affects all Apache Shiro versions through 2.2.0, and 3.0.0-alpha-1
when using <code>DefaultLdapRealm</code>.</p>
</div>
