Thanks. I suppose that, for now, we can wait for the next release. One of the biggest challenges that developers like me face with these types of vulnerabilities, even when the actual risk is low or non-existent, is the constant pressure from security scanners in enterprise environments. While this is not necessarily a problem that the Shiro PMC can solve directly, it is something that I would appreciate being considered in the future.
When scanners report that a fixed version is available, it often creates a continuous back-and-forth with security and compliance teams, who expect an upgrade path to exist. If that version is not actually available yet, it can become difficult to explain and justify. In that sense, I would have preferred a CVE record that indicated no fix was available yet rather than one that suggested a fix existed when it had not been released. If the Shiro PMC(or whoever can do that) can update the security report[1] to reflect the actual status of the CVE, that would be appreciated as the current wording "Mitigation: Upgrade to version 2.2.1" is confusing when that version is not out yet. [1] https://shiro.apache.org/security-reports.html From: <[email protected]> To: <[email protected]> Date: Sun, 07 Jun 2026 22:35:10 -0400 Subject: Re: Confused about CVE-2026-48589 Disclaimer: The below is my opinion only and doesn’t necessarily represent the position of Shiro PMC, or the ASF. Thank you for understanding, Yeikel, To be honest, the CVE process pretty broken currently. If you look at the CVE link, it defaults to CVSS 3.x metric, which gives it a score of 5.4 (Medium) However, this CVE was created using CVSS 4.0 metric, which gives it a score of 0.0 (None) - which is the intended, correct score. This vulnerability, while technically such, is barely so, and thus decision was made (correct or not) to risk not having a patched version it time. If you would like to help the project, please do so, financially or otherwise. While we cannot promise an expedited release, any contributions do help move ASF projects forward. On Jun 7, 2026, at 9:37 AM, Yeikel Santana < mailto:[email protected] > wrote: Thanks for the clarification, and I appreciate the work that you and the rest of the team are putting into the project. I also apologize if my comment came across as demanding; that wasn't my intention. I was mostly thinking out loud and trying to understand the situation. What surprised me was seeing a CVE published with vulnerability details available publicly while there doesn't appear to be a corresponding fixed release yet. In most cases I've seen, the process is the opposite, where a fix is prepared or released before detailed public disclosure. My concern is that having the vulnerability details publicly available without a patch in place can increase risk for users and the broader community. Public disclosure without an available remediation doesn't align with what I would typically consider responsible disclosure, since it can provide useful information to attackers before defenders have a chance to update. That said, I completely understand that open source projects are maintained by volunteers and that there are competing priorities and limited resources. I'm certainly not in any position to make demands; I was simply sharing my thoughts and observations If there is anything I can do to help move the release forward, whether technical contributions or other forms of support, I'd be happy to assist where I can. Thanks again for the explanation and for the effort the team is investing in maintaining the project and handling security reports. ---- On Sun, 07 Jun 2026 00:00:00 -0400 mailto:[email protected] wrote ---- Disclaimer: The below is my opinion only and doesn’t necessarily represent the position of Shiro PMC, or the ASF. Apologies for the confusion, but please understand that this project is run by volunteers. The new version was supposed to be released already, but got delayed. We got 20+ security reports of varying quality and content size (AI-generated and not) in the last 2 months, which all need attention. If you have issues, the Shiro team and/or the ASF is glad to accept contributions, financial and otherwise. See https://shiro.apache.org/blog/2026/04/community-effort.html On Jun 6, 2026, at 10:34 PM, Yeikel Santana < mailto:[email protected] > wrote: Thanks for the response. It's confusing that the official advisory points to a version that doesn't exist yet[1] I get that this might be the standard process, but in practice it causes real problems as scanners pick up these recommendations and suggest upgrade paths that aren't actually available. It would be great to be upfront about this: if there's no fix yet, just say so. Pointing users to a non-existent version creates confusion and doesn't help anyone [1] https://shiro.apache.org/security-reports.html#cve_2026_48589 ---- On Sat, 06 Jun 2026 23:25:20 -0400 mailto:[email protected] wrote ---- Hi, Yeikel, As you have guessed, the CVE is referencing a new version that is still pending a release. On Jun 6, 2026, at 3:54 PM, Yeikel Santana < mailto:[email protected] > wrote: Hi all, Apologies if this has already been discussed, but I'm a bit confused about CVE-2026-48589: https://nvd.nist.gov/vuln/detail/CVE-2026-48589 The advisory appears to reference a version 2.2.1, but I haven't been able to find that version in Maven Central or any other package registry. From the GitHub releases and repository activity, it looks like 2.2.0 is still the latest released version. Am I missing something, or is the CVE referencing a version that is pending? Thanks
