This is an automated email from the ASF dual-hosted git repository.
lprimak pushed a commit to branch asf-site
in repository https://gitbox.apache.org/repos/asf/shiro-site.git
The following commit(s) were added to refs/heads/asf-site by this push:
new 1d6bf063a update August 27
1d6bf063a is described below
commit 1d6bf063a21576a45834c49337be55e96fe00a1a
Author: lprimak <[email protected]>
AuthorDate: Thu Aug 27 12:15:18 2026 -0500
update August 27
---
.well-known/security.txt | 2 +-
feed.xml | 2 +-
integration.html | 2 +-
security-reports.html | 18 ++++++++++++++++++
4 files changed, 21 insertions(+), 3 deletions(-)
diff --git a/.well-known/security.txt b/.well-known/security.txt
index afb0d18f9..5d60bda7d 100644
--- a/.well-known/security.txt
+++ b/.well-known/security.txt
@@ -1,5 +1,5 @@
Contact: mailto:[email protected]
-Expires: 2027-07-07T00:50:15Z
+Expires: 2027-08-27T17:14:41Z
Preferred-Languages: en
Canonical: https://shiro.apache.org/.well-known/security.txt
Policy: https://shiro.apache.org/security-reports.html
\ No newline at end of file
diff --git a/feed.xml b/feed.xml
index 52024bc3e..27c6b046d 100644
--- a/feed.xml
+++ b/feed.xml
@@ -4,7 +4,7 @@
<subtitle>Simple. Java. Security.</subtitle>
<link href="https://shiro.apache.org/"/>
<link rel="self" href="https://shiro.apache.org/feed.xml"; />
- <updated>2026-07-07T00:50:16Z</updated>
+ <updated>2026-08-27T17:14:42Z</updated>
<author>
<name>Les Hazlewood</name>
diff --git a/integration.html b/integration.html
index 8cb1d1cc3..908b4dd65 100644
--- a/integration.html
+++ b/integration.html
@@ -494,7 +494,7 @@ This module had been moved into Apache Shiro.
<div class="sectionbody">
<div class="paragraph">
<p>Have an integration you want listed?
-Send us a pull request of <a
href="https://github.com/apache/shiro-site/blob/main/integration.md";>this
page</a>, and participate in Shiro development!</p>
+Send us a pull request of <a
href="https://github.com/apache/shiro-site/blob/main/src/site/content/integration.adoc";>this
page</a>, and participate in Shiro development!</p>
</div>
<div class="paragraph">
<p><a href="how-to-contribute.html">Learn more about contributing to Apache
Shiro</a>.</p>
diff --git a/security-reports.html b/security-reports.html
index 20fc39d34..d7edacdb9 100644
--- a/security-reports.html
+++ b/security-reports.html
@@ -233,6 +233,7 @@
<li><a href="#vulnerability_handling_process">Vulnerability Handling
Process</a></li>
<li><a href="#apache_shiro_vulnerability_reports">Apache Shiro Vulnerability
Reports</a>
<ul class="sectlevel2">
+<li><a href="#cve_2026_58301">CVE-2026-58301</a></li>
<li><a href="#cve_2026_56091">CVE-2026-56091</a></li>
<li><a href="#cve_2026_56130">CVE-2026-56130</a></li>
<li><a href="#cve_2026_49268">CVE-2026-49268</a></li>
@@ -309,6 +310,23 @@ We cannot accept regular bug reports or other queries at
this address.</p>
<h2 id="apache_shiro_vulnerability_reports">Apache Shiro Vulnerability
Reports</h2>
<div class="sectionbody">
<div class="sect2">
+<h3 id="cve_2026_58301"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58301";>CVE-2026-58301</a></h3>
+<div class="paragraph">
+<p>When Apache Shiro is used with the Jakarta EE integration module, a
low-privileged user can craft an HTTP request that causes the server to
initiate a connection to an attacker-controlled URL and transmit
attacker-controlled data. This vulnerability affects Apache Shiro versions 2.x
through 3.0.0 only in deployments that use the Jakarta EE integration
module.</p>
+</div>
+<div class="paragraph">
+<p><strong>Mitigation:</strong>
+Upgrade to version 3.0.1 or later, which fixes the issue.<br>
+Alternatively, you can set the
<code>org.apache.shiro.form-resubmit-host</code> (String) and
<code>org.apache.shiro.form-resubmit-port</code> (Integer) system properties to
restrict the host and port that Shiro will connect to when resubmitting a
form.</p>
+</div>
+<div class="paragraph">
+<p><strong>Credit:</strong>
+Apache Shiro would like to thank the following people for reporting this
issue: <strong><a href="https://lzhou1110.github.io/";>Liyi</a></strong>,
<strong><a href="https://zyy0530.github.io/";>Ziyue</a></strong>,
+<strong><a href="https://str1ckl4nd.github.io/";>Strick</a></strong>,
<strong><a href="http://maurice.busystar.org/";>Maurice</a></strong>, and
<strong><a href="https://7thparkk.github.io/";>Chenchen</a></strong>.
+We would also like to thank <strong>Andrea Cosentino</strong> for finding a
weakness in the remediation and reporting it to us.</p>
+</div>
+</div>
+<div class="sect2">
<h3 id="cve_2026_56091"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-56091";>CVE-2026-56091</a></h3>
<div class="paragraph">
<p>When using Apache Shiro with the <code>shiro-guice</code> module in a web
servlet context, a specially crafted HTTP request may cause an authentication
bypass.
