user  

Messages by Thread

• CVE-2026-129349: Apache Shiro: DefaultLdapRealm accepts any password when authentication caching is enabled Lenny Primak via user
  • Re: CVE-2026-129349: Apache Shiro: DefaultLdapRealm accepts any password when authentication caching is enabled Andreas Reichel
• CVE-2026-129348: Apache Shiro: PropertiesRealm reload does not remove deleted users or narrowed permissions Lenny Primak via user
• CVE-2026-129347: Apache Shiro: Empty stored credential matches an empty submitted password Lenny Primak via user
• CVE-2026-88019: Apache Shiro: Saved form replay may weaken cookie security and expose form data Lenny Primak via user
• CVE-2026-129320: Apache Shiro: Principal tags in Jakarta Pages and Jakarta Faces do not escape output, allowing cross-site scripting Lenny Primak via user
• CVE-2026-114737: Apache Shiro: Incorrect default for case-insensitive path matching in ShiroFilterFactoryBean allows auth bypass for static files Lenny Primak via user
• [ANNOUNCE] Apache Shiro 3.0.2 released Lenny Primak via user
• [VOTE] Release Apache Shiro 3.0.2 Lenny Primak via user
  • Re: [VOTE] Release Apache Shiro 3.0.2 Lenny Primak via user
• [VOTE] Apache Shiro 3.0.2 Francois Papon via user
  • Re: [VOTE] Apache Shiro 3.0.2 Lenny Primak via user
  • [CANCEL][VOTE] Apache Shiro 3.0.2 Francois Papon via user
• Please help with org.wicketstuff:wicketstuff-shiro migration to 3.0.x Maxim Solodovnik
  • Re: Please help with org.wicketstuff:wicketstuff-shiro migration to 3.0.x Lenny Primak
  • Re: Please help with org.wicketstuff:wicketstuff-shiro migration to 3.0.x Maxim Solodovnik
  • Re: Please help with org.wicketstuff:wicketstuff-shiro migration to 3.0.x Lenny Primak
  • Re: Please help with org.wicketstuff:wicketstuff-shiro migration to 3.0.x Maxim Solodovnik
• [ANNOUNCE] Apache Shiro 3.0.1 released Lenny Primak
• [RESULT][VOTE] Release Apache Shiro 3.0.1 Lenny Primak
• [VOTE] Release Apache Shiro 3.0.1 Lenny Primak
  • Re: [VOTE] Release Apache Shiro 3.0.1 Lenny Primak
  • Re: [VOTE] Release Apache Shiro 3.0.1 Francois Papon
  • Re: [VOTE] Release Apache Shiro 3.0.1 Jean-Baptiste Onofré
  • Re: [VOTE] Release Apache Shiro 3.0.1 Lenny Primak
• [ANNOUNCE] Apache Shiro 2.2.1 released Lenny Primak
• [RESULT][VOTE] Release Apache Shiro 3.0.0 lenny
  • Re: [RESULT][VOTE] Release Apache Shiro 3.0.0 Emond Papegaaij
  • Re: [RESULT][VOTE] Release Apache Shiro 3.0.0 Emond Papegaaij
  • Re: [RESULT][VOTE] Release Apache Shiro 3.0.0 Lenny Primak
  • Re: [RESULT][VOTE] Release Apache Shiro 3.0.0 Emond Papegaaij
  • Re: [RESULT][VOTE] Release Apache Shiro 3.0.0 Lenny Primak
• [VOTE] Release Apache Shiro 3.0.0 lenny
  • Re: [VOTE] Release Apache Shiro 3.0.0 lenny
  • Re: [VOTE] Release Apache Shiro 3.0.0 Francois Papon
  • Re: [VOTE] Release Apache Shiro 3.0.0 Andreas Reichel
  • Re: [VOTE] Release Apache Shiro 3.0.0 Francois Papon
  • Re: [VOTE] Release Apache Shiro 3.0.0 Andreas Reichel
  • Re: [VOTE] Release Apache Shiro 3.0.0 Francois Papon
  • Re: [VOTE] Release Apache Shiro 3.0.0 Jean-Baptiste Onofré
  • Re: [VOTE] Release Apache Shiro 3.0.0 Benjamin Marwell
• Documentation site has been updated with new information about 2.2.1 lenny
• [RESULT][VOTE] Release Apache Shiro 2.2.1 Francois Papon
• [VOTE] Release Apache Shiro 2.2.1 Francois Papon
  • Re: [VOTE] Release Apache Shiro 2.2.1 lenny
  • Re: [VOTE] Release Apache Shiro 2.2.1 lenny
  • Re: [VOTE] Release Apache Shiro 2.2.1 Francois Papon
  • Re: [VOTE] Release Apache Shiro 2.2.1 Yeikel Santana
  • Re: [VOTE] Release Apache Shiro 2.2.1 Benjamin Marwell
• Confused about CVE-2026-48589 Yeikel Santana
  • Re: Confused about CVE-2026-48589 lenny
  • Re: Confused about CVE-2026-48589 Yeikel Santana
  • Re: Confused about CVE-2026-48589 lenny
  • Re: Confused about CVE-2026-48589 Yeikel Santana
  • Re: Confused about CVE-2026-48589 lenny
  • Re: Confused about CVE-2026-48589 Yeikel Santana
• [RESULT][VOTE] Release Apache Shiro 2.2.0 Francois Papon
• [VOTE] Release Apache Shiro 2.2.0 Francois Papon
  • Re: [VOTE] Release Apache Shiro 2.2.0 lenny
  • Re: [VOTE] Release Apache Shiro 2.2.0 Jean-Baptiste Onofré
• Last call for feedback - 3.x vs. 2.x and upcoming CVEs lenny
  • Re: Last call for feedback - 3.x vs. 2.x and upcoming CVEs Andrew G10i
  • Re: Last call for feedback - 3.x vs. 2.x and upcoming CVEs lenny
  • Re: Last call for feedback - 3.x vs. 2.x and upcoming CVEs Andrew G10i
  • Re: Last call for feedback - 3.x vs. 2.x and upcoming CVEs lenny
  • Re: Last call for feedback - 3.x vs. 2.x and upcoming CVEs Andrew G10i
  • Re: Last call for feedback - 3.x vs. 2.x and upcoming CVEs lenny
• Next release of 3.x? lenny
  • Feedback urgently needed - Re: Next release of 3.x? lenny
  • Re: Feedback urgently needed - Re: Next release of 3.x? lenny
  • Re: Feedback urgently needed - Re: Next release of 3.x? Andreas Reichel
  • Re: Feedback urgently needed - Re: Next release of 3.x? lenny
  • Re: Feedback urgently needed - Re: Next release of 3.x? Andreas Reichel
  • Re: Feedback urgently needed - Re: Next release of 3.x? Lenny Primak
• Shiro 2.1.0 JakartaEE and JSP Bart van Leeuwen via user
  • Re: Shiro 2.1.0 JakartaEE and JSP bart_van_leeuwen.netage.nl via user
• [RESULT][VOTE] Release Apache Shiro 3.0.0-alpha-1 lenny
• [VOTE] Release Apache Shiro 3.0.0-alpha-1 lenny
  • Re: [VOTE] Release Apache Shiro 3.0.0-alpha-1 lenny
  • Re: [VOTE] Release Apache Shiro 3.0.0-alpha-1 Jean-Baptiste Onofré
• Release 3.0.0-Alpha-1? lenny
  • Re: Release 3.0.0-Alpha-1? Jean-Baptiste Onofré
• [ANNOUNCE] Apache Shiro 2.1.0 released Francois Papon
  • [ANNOUNCE] Apache Shiro 2.1.0 released Francois Papon
  • [ANNOUNCE] Apache Shiro 2.1.0 released lenny
• CVE-2026-23901: Apache Shiro: Brute force attack possible to determine valid user names Lenny Primak
  • Re: CVE-2026-23901: Apache Shiro: Brute force attack possible to determine valid user names Roberto Bottoni
  • Re: CVE-2026-23901: Apache Shiro: Brute force attack possible to determine valid user names lenny
• CVE-2026-23903: Apache Shiro: Auth bypass when accessing static files only on case-insensitive filesystems Lenny Primak
• [RESULT][VOTE] Release Apache Shiro 2.1.0 Francois Papon
• [VOTE] Release Apache Shiro 2.1.0 Francois Papon
  • Re: [VOTE] Release Apache Shiro 2.1.0 lenny
  • Re: [VOTE] Release Apache Shiro 2.1.0 Jean-Baptiste Onofré
  • Re: [VOTE] Release Apache Shiro 2.1.0 Francois Papon
• Website updates lenny
  • Re: Website updates Francois Papon
• Caching support for 3.x - Seeking feedback lenny
• Recent Shiro 3.x work lenny
• [ANNOUNCE} GitHub discussions and "squash and merge" are now enabled lenny
• Shiro dependency on obsolete commons-configurations 3.x lenny
• [ANNOUNCE] Apache Shiro 2.0.6 Francois Papon
• [RESULT][VOTE] Apache Shiro 2.0.6 release Francois Papon
• [VOTE] Release Apache Shiro 2.0.6 Francois Papon
  • Re: [VOTE] Release Apache Shiro 2.0.6 Francois Papon
  • Re: [VOTE] Release Apache Shiro 2.0.6 lenny
  • Re: [VOTE] Release Apache Shiro 2.0.6 Francois Papon
  • Re: [VOTE] Release Apache Shiro 2.0.6 Jean-Baptiste Onofré
• BCrypt algorithm usage in Shiro 2 - Does anyone use it? lenny
  • Re: BCrypt algorithm usage in Shiro 2 - Does anyone use it? Andreas Reichel
  • Re: BCrypt algorithm usage in Shiro 2 - Does anyone use it? lenny
  • Re: BCrypt algorithm usage in Shiro 2 - Does anyone use it? lenny
  • Re: BCrypt algorithm usage in Shiro 2 - Does anyone use it? Andreas Reichel
  • Re: BCrypt algorithm usage in Shiro 2 - Does anyone use it? lenny
• Session Tracking Mode Martin Höller
  • Re: Session Tracking Mode lenny
  • Re: Session Tracking Mode Martin Höller
  • Re: Session Tracking Mode lenny
• Active Directory: getting all roles at once instead looping through Andreas Reichel
  • Re: Active Directory: getting all roles at once instead looping through lenny
  • Re: Active Directory: getting all roles at once instead looping through Andreas Reichel
  • Re: Active Directory: getting all roles at once instead looping through Andreas Reichel
• [ANNOUNCE] New Apache Shiro PMC Chair Lenny Primak Brian Demers
  • Re: [ANNOUNCE] New Apache Shiro PMC Chair Lenny Primak Erik Beeson
  • Re: [ANNOUNCE] New Apache Shiro PMC Chair Lenny Primak lenny
• [ANNOUNCE] Apache Shiro 2.0.5 Released! lenny
• [RESULT][VOTE] Apache Shiro 2.0.5 release lenny
• [VOTE] Release Apache Shiro 2.0.5 lenny
  • Re: [VOTE] Release Apache Shiro 2.0.5 lenny
  • Re: [VOTE] Release Apache Shiro 2.0.5 Francois Papon
  • Re: [VOTE] Release Apache Shiro 2.0.5 Benjamin Marwell
  • [VOTE] Release Apache Shiro 2.0.5 Craig Muchinsky via user
  • Re: [VOTE] Release Apache Shiro 2.0.5 Craig Muchinsky via user
  • Re: [VOTE] Release Apache Shiro 2.0.5 Craig Muchinsky via user
  • Re: [VOTE] Release Apache Shiro 2.0.5 lenny
• [ANNOUNCE] Apache Shiro 2.0.4 Released! lenny
• [VOTE] Release Apache Shiro 2.0.4 lenny
  • Re: [VOTE] Release Apache Shiro 2.0.4 lenny
  • Re: [VOTE] Release Apache Shiro 2.0.4 lenny
  • Re: [VOTE] Release Apache Shiro 2.0.4 Jean-Baptiste Onofré
  • [RESULT][VOTE] Apache Shiro 2.0.4 release lenny
• Critical bug found - Feedback requested lenny
  • Re: Critical bug found - Feedback requested Benjamin Marwell
  • Re: Critical bug found - Feedback requested lenny
  • Re: Critical bug found - Feedback requested Tamás Cservenák
  • Re: Critical bug found - Feedback requested lenny
• [RESULT][VOTE] Apache Shiro 2.0.3 release lenny
• [VOTE] Release Apache Shiro 2.0.3 lenny
  • Re: [VOTE] Release Apache Shiro 2.0.3 lenny
  • Re: [VOTE] Release Apache Shiro 2.0.3 Benjamin Marwell
• Enabling GitHub Discussions? lenny
  • Re: Enabling GitHub Discussions? Francois Papon
  • Re: Enabling GitHub Discussions? Brian Demers
• Using 2nd FA for realms, here ENTRUST Andreas Reichel
  • Re: Using 2nd FA for realms, here ENTRUST lenny
  • Re: Using 2nd FA for realms, here ENTRUST Andreas Reichel
• Quarkus Extension? shiro
  • Re: Quarkus Extension? lenny
  • Re: Quarkus Extension? shiro
  • Re: Quarkus Extension? Lenny Primak
  • Re: Quarkus Extension? shiro
  • Re: Quarkus Extension? lenny
• Shiro 1.13 migration to Tomcat 10.1 (jakarta); issue with ehcache Steve Lopez via user
  • Re: Shiro 1.13 migration to Tomcat 10.1 (jakarta); issue with ehcache lenny
  • Unsubscribe Samuel S
• [RESULT][VOTE] Apache Shiro 2.0.2 release lenny
• Reminder: [OVERDUE][VOTE] Release Apache Shiro 2.0.2 lenny
  • Re: Reminder: [OVERDUE][VOTE] Release Apache Shiro 2.0.2 Jiri Jetmar
• [Reminder] Shiro 2.0.2 is on vote lenny
• Shiro 2.0.0 lenny
  • Re: Shiro 2.0.0 Francois Papon
• Subject/Principal question shiro
  • Re: Subject/Principal question lenny
  • Re: Subject/Principal question shiro
  • Re: Subject/Principal question lenny
• Unsubscribe Soto Souza, Alber
• overriding existing Subject in thread? shiro
  • Re: overriding existing Subject in thread? Francois Papon
  • Re: overriding existing Subject in thread? shiro
  • Re: overriding existing Subject in thread? Brian Demers
  • Re: overriding existing Subject in thread? lenny
  • Re: overriding existing Subject in thread? shiro
  • Re: overriding existing Subject in thread? shiro
  • Re: overriding existing Subject in thread? lenny
  • Re: overriding existing Subject in thread? shiro
  • Re: overriding existing Subject in thread? lenny
• Re: Authorising against 120 roles fast lenny
  • Re: Authorising against 120 roles fast Andreas Reichel
  • Re: Authorising against 120 roles fast lenny
  • Re: Authorising against 120 roles fast Andreas Reichel
  • Re: Authorising against 120 roles fast lenny
  • Re: Authorising against 120 roles fast Andreas Reichel
  • Re: Authorising against 120 roles fast lenny
  • Re: Authorising against 120 roles fast Andreas Reichel
• Options to obfuscate the LDAP/JDBC Realm passwords in SHIRO.INI Andreas Reichel
  • Re: Options to obfuscate the LDAP/JDBC Realm passwords in SHIRO.INI Benjamin Marwell
  • Re: Options to obfuscate the LDAP/JDBC Realm passwords in SHIRO.INI Andreas Reichel
  • Re: Options to obfuscate the LDAP/JDBC Realm passwords in SHIRO.INI lenny
  • Re: Options to obfuscate the LDAP/JDBC Realm passwords in SHIRO.INI Andreas Reichel
• Request invitation to Slack community channel Arun K C
• Proposal: Change SNAPSHOT version template lenny

• Earlier messages