Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

apache/shenyu

              master @ 6c3110f
            

Fixes

CVEs

CRITICAL

Peak severity

42.5%

Coverage

Highlights

Auth Bypass: 28 prior fixes. Scrutinize any change in this area.

shenyu-admin: most-fixed (27 issues). Treat as high-risk during review.

35 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: The administration console has suffered repeatedly from missing RBAC annotations (@RequiresPermissions), loose Shiro anonymous routing filters, and flawed JWT validation where administrative privileges could be forged or bypassed entirely. This includes vulnerabilities such as CVE-2021-37580 and CVE-2022-23944.

Server-Side Request Forgery: The sandbox gateway proxying functionality (/sandbox/proxyGateway) allowed attackers to forge backend requests because it lacked host and port verification. Similar issues affected Swagger import routines, which bypass constraints via HTTP redirect loops.

Denial of Service: Gateway proxy execution paths frequently leak memory because reactive WebFlux DataBuffers are not properly released during stream termination or error sequences. Under high traffic, this leads directly to heap exhaustion.