Disclaimer: The below is my opinion only and doesn’t necessarily represent the position of Shiro PMC, or the ASF.
Apologies for the confusion, but please understand that this project is run by volunteers. The new version was supposed to be released already, but got delayed. We got 20+ security reports of varying quality and content size (AI-generated and not) in the last 2 months, which all need attention. If you have issues, the Shiro team and/or the ASF is glad to accept contributions, financial and otherwise. See https://shiro.apache.org/blog/2026/04/community-effort.html > On Jun 6, 2026, at 10:34 PM, Yeikel Santana <[email protected]> wrote: > > Thanks for the response. > > It's confusing that the official advisory points to a version that doesn't > exist yet[1] > > I get that this might be the standard process, but in practice it causes real > problems as scanners pick up these recommendations and suggest upgrade paths > that aren't actually available. > > It would be great to be upfront about this: if there's no fix yet, just say > so. Pointing users to a non-existent version creates confusion and doesn't > help anyone > > [1] https://shiro.apache.org/security-reports.html#cve_2026_48589 > > ---- On Sat, 06 Jun 2026 23:25:20 -0400 [email protected] wrote ---- > > Hi, Yeikel, > > As you have guessed, the CVE is referencing a new version that is still > pending a release. > > > On Jun 6, 2026, at 3:54 PM, Yeikel Santana <[email protected] > <mailto:[email protected]>> wrote: > > Hi all, > > Apologies if this has already been discussed, but I'm a bit confused about > CVE-2026-48589: > > https://nvd.nist.gov/vuln/detail/CVE-2026-48589 > > The advisory appears to reference a version 2.2.1, but I haven't been able to > find that version in Maven Central or any other package registry. From the > GitHub releases and repository activity, it looks like 2.2.0 is still the > latest released version. > > Am I missing something, or is the CVE referencing a version that is pending? > > Thanks > > >
