Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.apache.shiro:shiro-spring

3 known vulnerabilities (1 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
3 · 1 medium
Registry
Maven Central

Advisories 3

  • CVE-2026-23903Medium 5.3

    Apache Shiro: Auth bypass when accessing static files only on case-insensitive filesystems

    Affected: fixed in 2.1.0.

  • Apache Shiro before 1.7.1, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.

    Affected: fixed in 1.7.1.

  • Apache Shiro before 1.7.0, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.

    Affected: fixed in 1.7.0.