Server-side Request Forgery (SSRF) Affecting org.apache.shiro:shiro-jakarta-ee package, versions [2.0.0-alpha-0,3.0.1)
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JAVA-ORGAPACHESHIRO-19477229
- published1 Sept 2026
- disclosed31 Aug 2026
- creditLiyi, Ziyue, Strick, Maurice, Chenchen
Introduced: 31 Aug 2026
NewCVE-2026-58301 (opens in a new tab)How to fix?
Upgrade org.apache.shiro:shiro-jakarta-ee to version 3.0.1 or higher.
Overview
Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) through the FormResubmitSupport resubmission client in support/jakarta-ee/src/main/java/org/apache/shiro/ee/filters/FormResubmitSupport.java. An attacker can make the server initiate an outbound request to an attacker-controlled URL and send attacker-controlled form data by submitting a crafted HTTP request that reaches the form-resubmission path. In affected deployments using the Jakarta EE integration module, the vulnerable resubmit flow runs during request handling for low-privileged users and replays data as part of the resubmission check. This can expose internal network access and lets the attacker drive the server to contact arbitrary endpoints with chosen content.
Workarounds
- Set the
org.apache.shiro.form-resubmit-hostsystem property to a specific host so Shiro only resubmits forms to that host, reducing the chance of outbound requests to attacker-controlled URLs. - Set the
org.apache.shiro.form-resubmit-portsystem property to a specific port so Shiro only resubmits forms to that port, limiting where the server can connect during form resubmission.