Disclaimer: The below is my opinion only and doesn’t necessarily represent the position of Shiro PMC, or the ASF.
Thank you for understanding, Yeikel, To be honest, the CVE process pretty broken currently. If you look at the CVE link, it defaults to CVSS 3.x metric, which gives it a score of 5.4 (Medium) However, this CVE was created using CVSS 4.0 metric, which gives it a score of 0.0 (None) - which is the intended, correct score. This vulnerability, while technically such, is barely so, and thus decision was made (correct or not) to risk not having a patched version it time. If you would like to help the project, please do so, financially or otherwise. While we cannot promise an expedited release, any contributions do help move ASF projects forward. > On Jun 7, 2026, at 9:37 AM, Yeikel Santana <[email protected]> wrote: > > Thanks for the clarification, and I appreciate the work that you and the rest > of the team are putting into the project. I also apologize if my comment came > across as demanding; that wasn't my intention. I was mostly thinking out loud > and trying to understand the situation. > > What surprised me was seeing a CVE published with vulnerability details > available publicly while there doesn't appear to be a corresponding fixed > release yet. In most cases I've seen, the process is the opposite, where a > fix is prepared or released before detailed public disclosure. > > My concern is that having the vulnerability details publicly available > without a patch in place can increase risk for users and the broader > community. Public disclosure without an available remediation doesn't align > with what I would typically consider responsible disclosure, since it can > provide useful information to attackers before defenders have a chance to > update. > > That said, I completely understand that open source projects are maintained > by volunteers and that there are competing priorities and limited resources. > I'm certainly not in any position to make demands; I was simply sharing my > thoughts and observations > > If there is anything I can do to help move the release forward, whether > technical contributions or other forms of support, I'd be happy to assist > where I can. > > Thanks again for the explanation and for the effort the team is investing in > maintaining the project and handling security reports. > > > > > ---- On Sun, 07 Jun 2026 00:00:00 -0400 [email protected] > <mailto:[email protected]> wrote ---- > > Disclaimer: The below is my opinion only and doesn’t necessarily represent > the position of Shiro PMC, or the ASF. > > Apologies for the confusion, but please understand that this project is run > by volunteers. > The new version was supposed to be released already, but got delayed. > We got 20+ security reports of varying quality and content size (AI-generated > and not) in the last 2 months, which all need attention. > > If you have issues, the Shiro team and/or the ASF is glad to accept > contributions, financial and otherwise. > See https://shiro.apache.org/blog/2026/04/community-effort.html > > On Jun 6, 2026, at 10:34 PM, Yeikel Santana <[email protected] > <mailto:[email protected]>> wrote: > > Thanks for the response. > > It's confusing that the official advisory points to a version that doesn't > exist yet[1] > > I get that this might be the standard process, but in practice it causes real > problems as scanners pick up these recommendations and suggest upgrade paths > that aren't actually available. > > It would be great to be upfront about this: if there's no fix yet, just say > so. Pointing users to a non-existent version creates confusion and doesn't > help anyone > > [1] https://shiro.apache.org/security-reports.html#cve_2026_48589 > > ---- On Sat, 06 Jun 2026 23:25:20 -0400 [email protected] > <mailto:[email protected]> wrote ---- > > Hi, Yeikel, > > As you have guessed, the CVE is referencing a new version that is still > pending a release. > > > On Jun 6, 2026, at 3:54 PM, Yeikel Santana <[email protected] > <mailto:[email protected]>> wrote: > > Hi all, > > Apologies if this has already been discussed, but I'm a bit confused about > CVE-2026-48589: > > https://nvd.nist.gov/vuln/detail/CVE-2026-48589 > > The advisory appears to reference a version 2.2.1, but I haven't been able to > find that version in Maven Central or any other package registry. From the > GitHub releases and repository activity, it looks like 2.2.0 is still the > latest released version. > > Am I missing something, or is the CVE referencing a version that is pending? > > Thanks > > > > >
