Bug 2481296 (CVE-2026-43828) - CVE-2026-43828 apache-shiro: Apache Shiro: Information disclosure via insecure cookie handling
Summary: CVE-2026-43828 apache-shiro: Apache Shiro: Information disclosure via insecur...
Keywords:
Status: NEW
Alias: CVE-2026-43828
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-05-25 21:01 UTC by OSIDB Bzimport
Modified: 2026-07-01 02:17 UTC (History)
22 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-05-25 21:01:41 UTC 
Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute.



This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1.

Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue.

In the affected versions, Shiro-native session manager, as well as Remember-Me manager sends JSESSIONID and rememberMe cookies without 'secure' attribute by default.
Note You need to log in before you can comment on or make changes to this bug.