Most recent entries from all

certfr-2026-avi-1256 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2026-avi-1256

CLEANSTART-2026-KG68344 — Security fix for CVE-2026-23903 applied in: activemq 6.1.8-r1

Affected: CleanStart: activemq

Security vulnerability affects the activemq package. This issue is resolved in later releases. See references for vulnerability details.

cnvd-2026-12892

EUVD-2026-356619

fkie_cve-2026-23903

Authentication Bypass by Alternate Name vulnerability in Apache Shiro.

This issue affects Apache Shiro: before 2.0.7.

Users are recommended to upgrade to version 2.0.7, which fixes the issue.

The issue only effects static files. If static files are served from a case-insensitive filesystem, such as default macOS setup, static files may be accessed by varying the case of the filename in the request. If only lower-case (common default) filters are present in Shiro, they may be bypassed this way.

Shiro 2.1.0 and later has a new parameters to remediate this issue shiro.ini: filterChainResolver.caseInsensitive = true application.properties: shiro.caseInsensitive=true

Shiro 3.0.0 and later makes this the default in shiro.ini-based configurations. Shiro 3.0.1 and later makes this the default in all configurations, including programmatic and Spring / Spring Boot.

GHSA-c244-p6m5-vqj6 — Apache Shiro has an Authentication Bypass

Affected: Maven: org.apache.shiro:shiro-spring

### Impact

**Authentication Bypass:** A vulnerability exists in Apache Shiro that allows authentication bypass for static files when served from a case-insensitive filesystem (such as the default configuration on macOS or Windows).

The issue arises when Shiro's URL filters are configured with lower-case rules (a common default), but the underlying operating system treats mixed-case filenames as identical. An attacker can access protected static resources by varying the capitalization of the filename in the request (e.g., requesting `/SECRET.TXT` to bypass a rule for `/secret.txt`).

This issue specifically affects static file handling and does not impact dynamic resource paths that are case-sensitive.

### Patches Users should upgrade to Apache Shiro **2.1.0** or later.

**Important Configuration Note:** Version 2.1.0 introduces a new configuration parameter to handle case-insensitivity, which must be enabled manually to resolve the issue:

* **shiro.ini:** ```ini filterChainResolver.caseInsensitive = true ``` * **Spring Boot (application.properties):** ```properties shiro.caseInsensitive=true ```

*Note: Apache Shiro 3.0.0 (upcoming) will enable this setting by default.*

### Workarounds * Ensure that the filesystem hosting the application is case-sensitive (e.g., Linux/Unix). * Manually configure all Shiro filter chains to handle all possible case variations of protected filenames (not recommended due to complexity).

### Resources * [CVE-2026-239…

UBUNTU-CVE-2026-23903

Affected: Ubuntu:Pro:16.04:LTS: shiro, Ubuntu:Pro:18.04:LTS: shiro, Ubuntu:20.04:LTS: shiro, Ubuntu:22.04:LTS: shiro, Ubuntu:Pro:24.04:LTS: shiro, Ubuntu:25.10: shiro, Ubuntu:26.04:LTS: shiro

Authentication Bypass by Alternate Name vulnerability in Apache Shiro. This issue affects Apache Shiro: before 2.0.7. Users are recommended to upgrade to version 2.0.7, which fixes the issue. The issue only effects static files. If static files are served from a case-insensitive filesystem, such as default macOS setup, static files may be accessed by varying the case of the filename in the request. If only lower-case (common default) filters are present in Shiro, they may be bypassed this way. Shiro 2.1.0 and later has a new parameters to remediate this issue shiro.ini: filterChainResolver.caseInsensitive = true application.properties: shiro.caseInsensitive=true Shiro 3.0.0 and later makes this the default in shiro.ini-based configurations. Shiro 3.0.1 and later makes this the default in all configurations, including programmatic and Spring / Spring Boot.

WID-SEC-W-2026-1194 — Oracle Communications: Mehrere Schwachstellen

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Communications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.