Skip to content
OpenAdvisories

Product · Apache Software Foundation

Apache Shiro

17 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.8
    CVE-2026-49268 Public exploit

    Apache Shiro: LDAP DN Injection in DefaultLdapRealm

    A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied username input is directly concatenated into the LDAP DN template without any escaping of RFC 2253 special characters. …

    Apache Software Foundation Apache Shiro shiro shiro Debian Ubuntu Maven