This is an automated email from the ASF dual-hosted git repository.
lprimak pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/shiro-site.git
The following commit(s) were added to refs/heads/main by this push:
new ba27ef467 enh(security-reports): acknowledge Andrea Cosentino for
reporting a weakness in remediation enh(security-reports): add CVE-2026-58301
vulnerability - replay to arbitrary hosts - details and mitigation steps
ba27ef467 is described below
commit ba27ef46776e9ebdca7bcff33d70b464f0c91176
Author: lprimak <[email protected]>
AuthorDate: Thu Aug 27 12:11:00 2026 -0500
enh(security-reports): acknowledge Andrea Cosentino for reporting a
weakness in remediation
enh(security-reports): add CVE-2026-58301 vulnerability - replay to
arbitrary hosts - details and mitigation steps
---
src/site/content/security-reports.adoc | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/src/site/content/security-reports.adoc
b/src/site/content/security-reports.adoc
index e47e8537c..6cf502f93 100644
--- a/src/site/content/security-reports.adoc
+++ b/src/site/content/security-reports.adoc
@@ -30,6 +30,18 @@ A https://www.apache.org/security/committers.html[more
detailed description of t
== Apache Shiro Vulnerability Reports
+=== link:https://www.cve.org/CVERecord?id=CVE-2026-58301[CVE-2026-58301]
+When Apache Shiro is used with the Jakarta EE integration module, a
low-privileged user can craft an HTTP request that causes the server to
initiate a connection to an attacker-controlled URL and transmit
attacker-controlled data. This vulnerability affects Apache Shiro versions 2.x
through 3.0.0 only in deployments that use the Jakarta EE integration module.
+
+**Mitigation:**
+Upgrade to version 3.0.1 or later, which fixes the issue. +
+Alternatively, you can set the `org.apache.shiro.form-resubmit-host` (String)
and `org.apache.shiro.form-resubmit-port` (Integer) system properties to
restrict the host and port that Shiro will connect to when resubmitting a form.
+
+**Credit:**
+Apache Shiro would like to thank the following people for reporting this
issue: *https://lzhou1110.github.io/[Liyi]*,
*https://zyy0530.github.io/[Ziyue]*,
+*https://str1ckl4nd.github.io/[Strick]*,
*http://maurice.busystar.org/[Maurice]*, and
*https://7thparkk.github.io/[Chenchen]*.
+We would also like to thank *Andrea Cosentino* for finding a weakness in the
remediation and reporting it to us.
+
=== link:https://www.cve.org/CVERecord?id=CVE-2026-56091[CVE-2026-56091]
When using Apache Shiro with the `shiro-guice` module in a web servlet
context, a specially crafted HTTP request may cause an authentication bypass.
This vulnerability is similar to
link:https://www.cve.org/CVERecord?id=CVE-2020-1957[CVE-2020-1957], except that
it affects the `shiro-guice` module instead of the `shiro-spring` module.
