Package · Debian

shiro

23 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

High 8.8

CVE-2026-49268 Public exploit

Apache Shiro: LDAP DN Injection in DefaultLdapRealm

A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied username input is directly concatenated into the LDAP DN template without any escaping of RFC 2253 special characters. …

Apache Software Foundation Apache Shiro shiro shiro Debian Ubuntu Maven

Jun 17, 2026
High 7.5

CVE-2020-13933 Public exploit EPSS 44%

Authentication bypass in Apache Shiro

Apache Shiro before 1.6.0, when using Apache Shiro, a specially crafted HTTP request may cause an authentication bypass.

shiro shiro org.apache.shiro:shiro-core Debian Ubuntu Maven

Aug 17, 2020
High 7.5

CVE-2019-12422 Public exploit

Improper input validation in Apache Shiro

Apache Shiro before 1.4.2, when using the default "remember me" configuration, cookies could be susceptible to a padding attack.

Apache Shiro shiro shiro Debian Ubuntu Maven

Nov 18, 2019