DEBIAN-CVE-2026-23901
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-23901
- Import Source
- https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-23901.json
- JSON Data
- https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-23901
- Upstream
- Published
- 2026-02-10T10:15:59.240Z
- Modified
- 2026-02-13T12:01:10.141644Z
- Severity
-
- 2.5 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
- Summary
- [none]
- Details
-
Observable Timing Discrepancy vulnerability in Apache Shiro. This issue affects Apache Shiro: from 1., 2. before 2.0.7. Users are recommended to upgrade to version 2.0.7 or later, which fixes the issue. Prior to Shiro 2.0.7, code paths for non-existent vs. existing users are different enough, that a brute-force attack may be able to tell, by timing the requests only, determine if the request failed because of a non-existent user vs. wrong password. The most likely attack vector is a local attack only. Shiro security model https://shiro.apache.org/security-model.html#username_enumeration discusses this as well. Typically, brute force attack can be mitigated at the infrastructure level.
- References
Affected packages
Debian:11 / shiro
Package
- Name
- shiro
- Purl
- pkg:deb/debian/shiro?arch=source
Debian:12 / shiro
Package
- Name
- shiro
- Purl
- pkg:deb/debian/shiro?arch=source
Debian:13 / shiro
Package
- Name
- shiro
- Purl
- pkg:deb/debian/shiro?arch=source