Skip to content
OpenAdvisories

Product · Apache Software Foundation

Apache Shiro

17 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 8.8
    CVE-2026-49268 Public exploit

    Apache Shiro: LDAP DN Injection in DefaultLdapRealm

    A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied username input is directly concatenated into the LDAP DN template without any escaping of RFC 2253 special characters. …

    Apache Software Foundation Apache Shiro shiro shiro Debian Ubuntu Maven
  • Critical 9.8
    CVE-2023-34478 Public exploit

    Apache Shiro before 1.12.0, or 2.0.0-alpha-3, may be susceptible to a path traversal attack when used together with APIs or other web frameworks that route requests based on non-normalized requests.

    Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack that results in an authentication bypass when used together with APIs or other web frameworks that route requests based on non-normalized requests. Mitigation: Update …

    Apache Software Foundation Apache Shiro shiro shiro Debian Ubuntu Maven
  • Critical 9.8
    CVE-2022-32532 Public exploit EPSS 26%

    Authentication Bypass Vulnerability

    Apache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet containers. Applications using RegExPatternMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.

    Apache Software Foundation Apache Shiro shiro shiro Debian Ubuntu Maven
  • Critical 9.8
    CVE-2020-11989 Public exploit EPSS 24%

    Improper Authentication in Apache Shiro

    Apache Shiro before 1.5.3, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass.

    Apache Software Foundation Apache Shiro shiro shiro Debian Ubuntu Maven