Bug#1127942: shiro: CVE-2026-23903

[Salvatore Bonaccorso]

Source: shiro
Version: 1.3.2-5
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerability was published for shiro.

CVE-2026-23903[0]:
| Authentication Bypass by Alternate Name vulnerability in Apache
| Shiro.  This issue affects Apache Shiro: before 2.0.7.  Users are
| recommended to upgrade to version 2.0.7, which fixes the issue.  The
| issue only effects static files. If static files are served from a
| case-insensitive filesystem, such as default macOS setup, static
| files may be accessed by varying the case of the filename in the
| request. If only lower-case (common default) filters are present in
| Shiro, they may be bypassed this way.  Shiro 2.0.7 and later has a
| new parameters to remediate this issue shiro.ini:
| filterChainResolver.caseInsensitive = true application.propertie:
| shiro.caseInsensitive=true  Shiro 3.0.0 and later (upcoming) makes
| this the default.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-23903
    https://www.cve.org/CVERecord?id=CVE-2026-23903
[1] https://www.openwall.com/lists/oss-security/2026/02/08/1

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore