Thanks for the clarification, and I appreciate the work that you and the rest of the team are putting into the project. I also apologize if my comment came across as demanding; that wasn't my intention. I was mostly thinking out loud and trying to understand the situation.
What surprised me was seeing a CVE published with vulnerability details available publicly while there doesn't appear to be a corresponding fixed release yet. In most cases I've seen, the process is the opposite, where a fix is prepared or released before detailed public disclosure. My concern is that having the vulnerability details publicly available without a patch in place can increase risk for users and the broader community. Public disclosure without an available remediation doesn't align with what I would typically consider responsible disclosure, since it can provide useful information to attackers before defenders have a chance to update. That said, I completely understand that open source projects are maintained by volunteers and that there are competing priorities and limited resources. I'm certainly not in any position to make demands; I was simply sharing my thoughts and observations If there is anything I can do to help move the release forward, whether technical contributions or other forms of support, I'd be happy to assist where I can. Thanks again for the explanation and for the effort the team is investing in maintaining the project and handling security reports. ---- On Sun, 07 Jun 2026 00:00:00 -0400 mailto:[email protected] wrote ---- Disclaimer: The below is my opinion only and doesn’t necessarily represent the position of Shiro PMC, or the ASF. Apologies for the confusion, but please understand that this project is run by volunteers.The new version was supposed to be released already, but got delayed. We got 20+ security reports of varying quality and content size (AI-generated and not) in the last 2 months, which all need attention. If you have issues, the Shiro team and/or the ASF is glad to accept contributions, financial and otherwise. See https://shiro.apache.org/blog/2026/04/community-effort.html On Jun 6, 2026, at 10:34 PM, Yeikel Santana < mailto:[email protected] > wrote: Thanks for the response. It's confusing that the official advisory points to a version that doesn't exist yet[1] I get that this might be the standard process, but in practice it causes real problems as scanners pick up these recommendations and suggest upgrade paths that aren't actually available. It would be great to be upfront about this: if there's no fix yet, just say so. Pointing users to a non-existent version creates confusion and doesn't help anyone [1] https://shiro.apache.org/security-reports.html#cve_2026_48589 ---- On Sat, 06 Jun 2026 23:25:20 -0400 mailto:[email protected] wrote ---- Hi, Yeikel, As you have guessed, the CVE is referencing a new version that is still pending a release. On Jun 6, 2026, at 3:54 PM, Yeikel Santana < mailto:[email protected] > wrote: Hi all, Apologies if this has already been discussed, but I'm a bit confused about CVE-2026-48589: https://nvd.nist.gov/vuln/detail/CVE-2026-48589 The advisory appears to reference a version 2.2.1, but I haven't been able to find that version in Maven Central or any other package registry. From the GitHub releases and repository activity, it looks like 2.2.0 is still the latest released version. Am I missing something, or is the CVE referencing a version that is pending? Thanks
