CVE-2026-23903

描述

Authentication Bypass by Alternate Name vulnerability in Apache Shiro. This issue affects Apache Shiro: before 2.0.7. Users are recommended to upgrade to version 2.0.7, which fixes the issue. The issue only effects static files. If static files are served from a case-insensitive filesystem, such as default macOS setup, static files may be accessed by varying the case of the filename in the request. If only lower-case (common default) filters are present in Shiro, they may be bypassed this way. Shiro 2.0.7 and later has a new parameters to remediate this issue shiro.ini: filterChainResolver.caseInsensitive = true application.propertie: shiro.caseInsensitive=true Shiro 3.0.0 and later (upcoming) makes this the default.

如何修補 CVE-2026-23903

要修補 CVE-2026-23903,請將受影響套件升級到下列已修補版本。

• —未列出修補版本
• —升級至 2.1.0 或更新版本

CVE-2026-23903 正在被利用嗎?

低 — EPSS 為 0.4%,目前沒有觀察到大規模利用活動。

受影響套件(2)

• from 0
• from 0, < 2.1.0

CVSS 分數

參考連結(6)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2026-23903
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2026-23903
• PATCHgithub.com/apache/shiro
• WEBwww.openwall.com/lists/oss-security/2026/02/08/1
• WEB