GHSA-c6r4-qjmw-cvj2

Опубликовано: 26 мая 2026

Источник: github

Github: Прошло ревью

CVSS4: 5.9

Описание

Apache Shiro sends sensitive cookies in HTTPS session without 'Secure' attribute

Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute.

This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1.

Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue.

In the affected versions, Shiro-native session manager, as well as Remember-Me manager sends JSESSIONID and rememberMe cookies without 'secure' attribute by default.

Ссылки

Пакеты

Наименование

org.apache.shiro:shiro-web

maven

Затронутые версииВерсия исправления

>= 1.0.0-incubating, < 2.2.0

2.2.0

Наименование

org.apache.shiro:shiro-web

maven

Затронутые версииВерсия исправления

= 3.0.0-alpha-1

3.0.0-alpha-2

EPSS

Процентиль: 19%

0.00272

Низкий

5.9 Medium

CVSS4

CVE ID

CVE-2026-43828

Дефекты

CWE-614

Связанные уязвимости

CVE-2026-43828

CVSS3: 6.5

ubuntu

3 месяца назад

Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute. This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1. Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue. In the affected versions, Shiro-native session manager, as well as Remember-Me manager sends JSESSIONID and rememberMe cookies without 'secure' attribute by default.