{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-58301",
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"state": "PUBLISHED",
"assignerShortName": "apache",
"dateReserved": "2026-06-30T00:48:57.590Z",
"datePublished": "2026-08-31T07:40:37.337Z",
"dateUpdated": "2026-08-31T08:15:58.244Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache",
"dateUpdated": "2026-08-31T07:40:37.337Z"
},
"title": "Apache Shiro: Server-side POST request may be steered to an alternate host",
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"cweId": "CWE-918",
"type": "CWE"
}
]
}
],
"source": {
"discovery": "UNKNOWN"
},
"affected": [
{
"vendor": "Apache Software Foundation",
"product": "Apache Shiro",
"collectionURL": "https://repo.maven.apache.org/maven2",
"packageName": "org.apache.shiro:shiro-jakata-ee",
"versions": [
{
"status": "affected",
"version": "2.0.0-alpha-0",
"lessThanOrEqual": "3.0.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"value": "When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connection to an attacker-controlled URL and transmit attacker-controlled data. This vulnerability affects Apache Shiro versions 2.x through 3.0.0 only in deployments that use the Jakarta EE integration module.\n\nMitigation: Upgrade to version 3.0.1 or later, which fixes the issue. +\nAlternatively, you can set the `org.apache.shiro.form-resubmit-host` (String) and `org.apache.shiro.form-resubmit-port` (Integer) system properties to restrict the host and port that Shiro will connect to when resubmitting a form.",
"lang": "en",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connection to an attacker-controlled URL and transmit attacker-controlled data. This vulnerability affects Apache Shiro versions 2.x through 3.0.0 only in deployments that use the Jakarta EE integration module.
Mitigation: Upgrade to version 3.0.1 or later, which fixes the issue. +
Alternatively, you can set the `org.apache.shiro.form-resubmit-host` (String) and `org.apache.shiro.form-resubmit-port` (Integer) system properties to restrict the host and port that Shiro will connect to when resubmitting a form."
}
]
}
],
"references": [
{
"url": "https://lists.apache.org/thread/g1g84ovof5fnonvc5o89wym2jzt77fww",
"tags": [
"vendor-advisory"
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "LOW",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"Safety": "PRESENT",
"Automatable": "YES",
"Recovery": "USER",
"valueDensity": "DIFFUSE",
"vulnerabilityResponseEffort": "LOW",
"providerUrgency": "AMBER",
"version": "4.0",
"baseSeverity": "MEDIUM",
"baseScore": 5.9,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/S:P/AU:Y/R:U/V:D/RE:L/U:Amber"
}
}
],
"credits": [
{
"lang": "en",
"value": "liyi.zhou@sydney.edu.au (Liyi), https://lzhou1110.github.io/",
"type": "finder"
},
{
"lang": "en",
"value": "ziyue0530@gmail.com (Ziyue), https://zyy0530.github.io/",
"type": "finder"
},
{
"lang": "en",
"value": "cshe0476@uni.sydney.edu.au (Strick), https://str1ckl4nd.github.io/",
"type": "finder"
},
{
"lang": "en",
"value": "chng0012@uni.sydney.edu.au (Maurice), http://maurice.busystar.org/",
"type": "finder"
},
{
"lang": "en",
"value": "cyu210608@gmail.com (Chenchen), https://7thparkk.github.io/",
"type": "finder"
},
{
"lang": "en",
"value": "Lenny Primak ",
"type": "remediation developer"
},
{
"lang": "en",
"value": "Andrea Cosentino",
"type": "remediation reviewer"
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
},
"adp": [
{
"title": "CVE Program Container",
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/08/30/2"
}
],
"providerMetadata": {
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE",
"dateUpdated": "2026-08-31T08:15:58.244Z"
}
}
]
}
}