CVE-2026-23901

The record

Observable Timing Discrepancy vulnerability in Apache Shiro. This issue affects Apache Shiro: from 1.*, 2.* before 2.0.7. Users are recommended to upgrade to version 2.0.7 or later, which fixes the issue. Prior to Shiro 2.0.7, code paths for non-existent vs. existing users are different enough, that a brute-force attack may be able to tell, by timing the requests only, determine if the request failed because of a non-existent user vs. wrong password. The most likely attack vector is a local attack only. Shiro security model  https://shiro.apache.org/security-model.html#username_enumeration  discusses this as well. Typically, brute force attack can be mitigated at the infrastructure level.

Affected packages

Related vulnerabilities

• CVE-2016-4437 Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember… Also affects org.apache.shiro:shiro-core
• CVE-2026-1605 In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a… Also affects apache-jena-fuseki
• CVE-2025-11143 The Jetty URI parser has some key differences to other common parsers when evaluating… Also affects neo4j-5.26
• CVE-2026-1622 Neo4j Enterprise and Community editions versions prior to 2026.01.3 and 5.26.21 are… Also affects neo4j-5.26
• CVE-2025-68161 Apache Log4j does not verify the TLS hostname in its Socket Appender Also affects neo4j-5.26
• CVE-2025-67735 Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder Also affects neo4j-5.26
• CVE-2025-12383 Eclipse Jersey has a Race Condition Also affects neo4j-5.26
• CVE-2025-58056 Netty vulnerable to request smuggling due to incorrect parsing of chunk extensions Also affects neo4j-5.26