CVE-2022-32532: Apache Shiro

Critical severity, CVSS 9.8. EPSS: 25.5% chance of exploitation in the next 30 days.

Apache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet containers. Applications using RegExPatternMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.

Affected products

• Apache Shiro: before 1.9.1 (fixed in 1.9.1)

Published 2022-06-29. Last modified 2026-06-17.