NES for Apache Shiro 1.8.x Release Notes

Security Fixes

This release patches the following:

• Match request paths in RegExPatternMatcher across embedded newlines so a crafted path can no longer skip a filter-chain rule.
  • This fixes a Critical Severity Authorization Bypass vulnerability (CVE-2022-32532)
• Apply the Shiro filter chain to RequestDispatcher forwards and includes in OncePerRequestFilter.
  • This fixes a Critical Severity Authorization Bypass vulnerability (CVE-2022-40664)
• Reject traversal sequences in InvalidRequestFilter before the filter chain resolves the request path.
  • This fixes a Critical Severity Path Traversal vulnerability (CVE-2023-34478)
• Escape user-supplied principals when DefaultLdapRealm builds a user DN, so LDAP metacharacters can no longer alter the query.
  • This fixes a Critical Severity Authorization Bypass vulnerability (CVE-2026-49268)
• Normalize trailing slashes in the shiro-guice filter-chain resolver so they resolve to the same chain as the unslashed path.
  • This fixes a Critical Severity Authorization Bypass vulnerability (CVE-2026-56091)
• Force the Ant path matcher in the Shiro Spring Boot starter so Spring Boot 2.6+ path matching cannot diverge from the filter chain's.
  • This fixes a High Severity Authorization Bypass vulnerability (CVE-2023-22602)
• Reject semicolon-rewritten paths in InvalidRequestFilter before the filter chain resolves the request path.
  • This fixes a High Severity Path Traversal vulnerability (CVE-2023-46749)
• Collapse duplicate leading slashes in SavedRequest.getRequestUrl() so a saved request cannot redirect a logged-in user off-site.
  • This fixes a High Severity Open Redirect vulnerability (CVE-2023-46750)
• Rotate the session identifier on successful login in DefaultSecurityManager.
  • This fixes a High Severity Authorization Bypass vulnerability (CVE-2026-43827)
• Set the Secure attribute on Shiro's session and rememberMe cookies by default.
  • This fixes a High Severity Information Exposure vulnerability (CVE-2026-43828)
• Add opt-in case-insensitive path filtering so alternate-case request paths cannot skip a filter-chain rule.
  • This fixes a Medium Severity Authorization Bypass vulnerability (CVE-2026-23903)
• Equalize the credential-matching work performed for non-existent accounts so response timing no longer reveals whether a username exists.
  • This fixes a Low Severity Information Exposure vulnerability (CVE-2026-23901)
• Record a creation time in the rememberMe payload and enforce the cookie's configured maxAge on the server.
  • This fixes a Low Severity Authorization Bypass vulnerability (CVE-2026-56130)

Notes

• Case-insensitive path filtering (CVE-2026-23903) is opt-in. Enable it with the shiro.caseInsensitive=true property in Spring and Spring Boot applications, or with ShiroFilterFactoryBean.setCaseInsensitive(true).
• The rememberMe fix (CVE-2026-56130) changes the cookie payload format. Cookies issued before this release carry no creation time, so their age cannot be established and they are refused; affected users are prompted to log in once more, which reissues the cookie in the current format.
• CookieRememberMeManager's default maxAge is one year, and that lifetime is now enforced on the server. A negative maxAge enforces no lifetime, as before.