Apache Shiro has a session fixation vulnerability

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2026-43827 · ADVISORY
• apache/shiro · PACKAGE
• shiro.apache.org/security-reports.html · WEB
• openwall.com/lists/oss-security/2026/05/25/6 · WEB

org.apache.shiro:shiro-core のその他の脆弱性

• CVE-2026-49268緊急 9.1A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied …
• CVE-2026-23901低 2.5Observable Timing Discrepancy vulnerability in Apache Shiro. This issue affects Apache Shiro: from 1.*, 2.* before 2.0.7. Users are recomm…
• CVE-2023-46749中 6.5Apache Shiro before 1.13.0 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when use…
• CVE-2022-40664緊急 9.8Apache Shiro before 1.10.0, Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcher.
• CVE-2022-32532緊急 9.8Apache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet containers. Applications using RegExPat…