Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.apache.shiro:shiro-core

13 known vulnerabilities (2 critical, 1 high, 2 medium, 2 low), with the versions each affects and the releases that fix them.

Latest release
3.0.1 (Aug 23, 2026): no advisory affects it
Newest unaffected release
3.0.1 (Aug 23, 2026), the latest release
Advisories
13 · 2 critical, 1 high, 2 medium, 2 low
Dependents
65
Releases
48 since 1.0.0-incubating (May 21, 2010)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-56130
    Affects 1.2.4 to 3.0.0-alpha-1 (3.0.0 is outside it)
  • CVE-2026-49268
    Affects 1.0.0-incubating to 2.2.0 (2.2.1 is outside it); 3.0.0-alpha-1 (3.0.0 is outside it)
  • CVE-2026-43827
    Affects 1.0.0-incubating to 2.1.0 (2.2.0 is outside it); 3.0.0-alpha-1 (3.0.0 is outside it)
  • CVE-2026-23901
    Affects 1.0.0-incubating to 2.0.6 (2.1.0 is outside it)
  • CVE-2023-46749
    Affects 1.0.0-incubating to 1.12.0 (1.13.0 is outside it); 2.0.0-alpha-1 to 2.0.0-alpha-3 (2.0.0-alpha-4 is outside it)
  • CVE-2022-40664
    Affects 1.0.0-incubating to 1.9.1 (1.10.0 is outside it)
  • CVE-2022-32532
    Affects 1.0.0-incubating to 1.9.0 (1.9.1 is outside it)
  • CVE-2021-41303
    Affects 1.0.0-incubating to 1.7.1 (1.8.0 is outside it)
  • CVE-2020-13933
    Affects 1.0.0-incubating to 1.5.3 (1.6.0 is outside it)
  • CVE-2020-11989
    Affects 1.0.0-incubating to 1.5.2 (1.5.3 is outside it)
  • CVE-2020-1957
    Affects 1.0.0-incubating to 1.5.1 (1.5.2 is outside it)
  • CVE-2019-12422
    Affects 1.0.0-incubating to 1.4.1 (1.4.2 is outside it)
  • CVE-2016-4437
    Affects 1.0.0-incubating to 1.2.4 (1.2.5 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 13

  • Apache Shiro: Remember-me cookie isn't checked for expiry on the server

    Affected: from 1.2.4, fixed in 3.0.0.

    Fixed in 3.0.0 (released Jun 20, 2026, 5 days before disclosure).

    The latest release, 3.0.1, is not affected.

  • Apache Shiro: LDAP DN Injection in DefaultLdapRealm

    Affected: through 2.2.0; from 3.0.0-alpha-0, through 3.0.0-alpha-1; fixed in 2.2.1; from 3.0.0-alpha-0, fixed in 3.0.0-alpha-2.

    Fixed in 2.2.1 (released Jun 14, 2026, 3 days before disclosure) and 3.0.0 (released Jun 20, 2026, 3 days after disclosure, the advisory names 3.0.0-alpha-2, which was never published).

    The latest release, 3.0.1, is not affected.

  • CVE-2026-43827Medium 5.9

    Apache Shiro: Session fixation: new session is not created after login by default

    Affected: from 1.0, through 2.1.0; from 3.0.0-alpha-0, through 3.0.0-alpha-1; from 1.0.0-incubating, fixed in 2.2.0; from 3.0.0-alpha-1, fixed in 3.0.0-alpha-2.

    Fixed in 2.2.0 (released May 14, 2026, 11 days before disclosure) and 3.0.0 (released Jun 20, 2026, 26 days after disclosure, the advisory names 3.0.0-alpha-2, which was never published).

    The latest release, 3.0.1, is not affected.

  • Apache Shiro: Brute force attack possible to determine valid user names

    Affected: fixed in 2.0.7; fixed in 2.1.0.

    Fixed in 2.1.0 (released Feb 4, 2026, 6 days before disclosure).

    The latest release, 3.0.1, is not affected.

  • CVE-2023-46749Medium 6.5

    Apache Shiro before 1.13.0 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when…

    Affected: fixed in 1.13.0; from 2.0.0alpha1, fixed in 2.0.0-alpha4.

    Fixed in 1.13.0 (released Oct 31, 2023, 76 days before disclosure) and 2.0.0-alpha-4 (released Nov 7, 2023, 69 days before disclosure).

    The latest release, 3.0.1, is not affected.

  • CVE-2022-40664Critical 9.8

    Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcher

    Affected: fixed in 1.10.0.

    Fixed in 1.10.0 (released Oct 7, 2022, 5 days before disclosure).

    The latest release, 3.0.1, is not affected.

  • Authentication Bypass Vulnerability

    Affected: fixed in 1.9.1.

    Fixed in 1.9.1 (released Jun 23, 2022, 5 days before disclosure).

    The latest release, 3.0.1, is not affected.

  • Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypass

    Affected: fixed in 1.8.0.

    Fixed in 1.8.0 (released Aug 23, 2021, 25 days before disclosure).

    The latest release, 3.0.1, is not affected.

  • Apache Shiro before 1.6.0, when using Apache Shiro, a specially crafted HTTP request may cause an authentication bypass.

    Affected: fixed in 1.6.0.

    Fixed in 1.6.0 (released Aug 11, 2020, 6 days before disclosure).

    The latest release, 3.0.1, is not affected.

  • Apache Shiro before 1.5.3, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an…

    Affected: fixed in 1.5.3.

    Fixed in 1.5.3 (released Apr 26, 2020, 57 days before disclosure).

    The latest release, 3.0.1, is not affected.

  • Apache Shiro before 1.5.2, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an…

    Affected: fixed in 1.5.2.

    Fixed in 1.5.2 (released Mar 18, 2020, 7 days before disclosure).

    The latest release, 3.0.1, is not affected.

  • Apache Shiro before 1.4.2, when using the default "remember me" configuration, cookies could be susceptible to a padding attack.

    Affected: fixed in 1.4.2.

    Fixed in 1.4.2 (released Nov 8, 2019, 10 days before disclosure).

    The latest release, 3.0.1, is not affected.

  • CVE-2016-4437Critical 9.8 · KEV

    Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbit

    Affected: fixed in 1.2.5.

    Fixed in 1.2.5 (released May 19, 2016, 19 days before disclosure).

    The latest release, 3.0.1, is not affected.