PT-2026-43119 · Apache · Apache Shiro

Meteor_Kai · CVE-2026-43828 · Published 2026-05-25 · Updated 2026-05-28

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Shiro versions 1.0 through 2.1.0 Apache Shiro version 3.0.0-alpha-1

Description Default configurations cause the Shiro-native session manager and the Remember-Me manager to send JSESSIONID and rememberMe cookies without the 'Secure' attribute during HTTPS sessions. The 'Secure' attribute is a flag that ensures cookies are only transmitted over encrypted connections, preventing them from being sent in cleartext.

Recommendations For versions 1.0 through 2.1.0, upgrade to version 2.1.1 or later. For version 3.0.0-alpha-1, upgrade to version 3.0.0-alpha-2 or later.

Fix

Weakness Enumeration

CWE-614

Related Identifiers

CVE-2026-43828

GHSA-C6R4-QJMW-CVJ2

Affected Products

Apache Shiro

References · 12

• https://cve.org/CVERecord?id=CVE-2026-43828 · Security Note
• https://shiro.apache.org/security-reports.html#cve_2026_43828 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43828 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43828 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c6r4-qjmw-cvj2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-43828 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-43828 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-43828 · Security Note
• https://github.com/apache/shiro · Note
• http://openwall.com/lists/oss-security/2026/05/25/7 · Note
• https://openwall.com/lists/oss-security/2026/05/25/7 · Note
• https://t.me/cveNotify/165009 · Telegram Post