Vulnerability GHSA-x96m-rh44-vgv8
High Risk
HIGH RISK
CVSS Score: 8.0
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
4 months ago
June 17, 2026 at 06:35 PM UTC
Apache Shiro: LDAP DN Injection in DefaultLdapRealm
1.0.0-incubating - 2.2.0 and 3.0.0-alpha-1
1.0.0-incubating - 2.2.0 and 3.0.0-alpha-1
Summary
Apache Shiro: LDAP DN Injection in DefaultLdapRealm
Details
A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied username input is directly concatenated into the LDAP DN template without any escaping of RFC 2253 special characters. This allows an attacker to manipulate the DN structure used for LDAP bind authentication, potentially bypassing authentication or impersonating other users.
This issue affects all Apache Shiro versions through 2.2.0, and 3.0.0-alpha-1 when using DefaultLdapRealm Upgrade to Apache Shiro 2.2.1 or 3.0.0-alpha-2 or later, which fixes the issue.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Low Risk
4 months ago
Apache Shiro's "remember me" cookie age is not verified on the server.
1.2.4 - 3.0.0-alpha-1 GHSA-m8g6-vrr2-x7ff
1.2.4 - 3.0.0-alpha-1 GHSA-m8g6-vrr2-x7ff
Medium Risk
5 months ago
Apache Shiro has a session fixation vulnerability
1.0.0-incubating - 2.1.0 and 3.0.0-alpha-1 GHSA-fcvm-3cpj-f9qx
1.0.0-incubating - 2.1.0 and 3.0.0-alpha-1 GHSA-fcvm-3cpj-f9qx
Low Risk
8 months ago
Apache Shiro Affected by an Observable Timing Discrepancy Vulnerability
1.0.0-incubating - 2.0.6 GHSA-c4qc-4q9p-m9q9
1.0.0-incubating - 2.0.6 GHSA-c4qc-4q9p-m9q9
Medium Risk
2 years ago
Apache Shiro vulnerable to path traversal
1.0.0-incubating - 1.12.0 and 2.0.0-alpha-1 - 2.0.0-alpha-3 GHSA-jc7h-c423-mpjc
1.0.0-incubating - 1.12.0 and 2.0.0-alpha-1 - 2.0.0-alpha-3 GHSA-jc7h-c423-mpjc
Critical
4 years ago
Apache Shiro Authentication Bypass vulnerability
1.0.0-incubating - 1.9.1 GHSA-45x9-q6vj-cqgq
1.0.0-incubating - 1.9.1 GHSA-45x9-q6vj-cqgq
Impacted packages
Timeline
Published
4 months ago
June 17, 2026 at 06:35 PM UTC
Fixed (2.2.1)
Unknown
Unknown
Last Modified
1 month ago
September 10, 2026 at 03:50 AM UTC