CVE-2026-47842
published 2026-08-26CVE-2026-47842: Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with…
PriorityP337medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
0.15%
4.1th percentile
Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null (all-zero) initialization vector.
Spring Security 7.1.0
Spring Security 7.0.0 - 7.0.6
Spring Security 6.5.0 - 6.5.11
Spring Security 6.4.0 - 6.4.18
Spring Security 5.8.0 - 5.8.27
Spring Security 5.7.0 - 5.7.25
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| devspaces | openvsx-rhel9 | — | — |
| devspaces | pluginregistry-rhel9 | — | — |
| jenkins | jenkins | — | — |
| ocp-tools-4 | jenkins-rhel8 | — | — |
| ocp-tools-4 | jenkins-rhel9 | — | — |
| spring | spring_security | — | — |
| spring | spring_security | 5.7.0 – 5.7.25 | — |
| spring | spring_security | 5.8.0 – 5.8.27 | — |
| spring | spring_security | 6.4.0 – 6.4.18 | — |
| spring | spring_security | 6.5.0 – 6.5.11 | — |
| spring | spring_security | 7.0.0 – 7.0.6 | — |
| vmware | spring_security | >= 5.7.0 < 5.7.26 | 5.7.26 |
| vmware | spring_security | >= 5.8.0 < 5.8.28 | 5.8.28 |
| vmware | spring_security | >= 6.4.0 < 6.4.19 | 6.4.19 |
| vmware | spring_security | >= 6.5.0 < 6.5.12 | 6.5.12 |
| vmware | spring_security | >= 7.0.0 < 7.0.6.1 | 7.0.6.1 |
| vmware | spring_security | >= 7.1.0 < 7.1.0.1 | 7.1.0.1 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null (all-zero) initializati
ghsa_unreviewed·2026-08-26
CVE-2026-47842 [MEDIUM] Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null (all-zero) initializati
Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null (all-zero) initialization vector.
Spring Security 7.1.0
Spring Security 7.0.0 - 7.0.6
Spring Security 6.5.0 - 6.5.11
Spring Security 6.4.0 - 6.4.18
Spring Security 5.8.0 - 5.8.27
Spring Security 5.7.0 - 5.7.25
VulDB
VMware Spring Security up to 7.1.0 Initialization Vector predictable iv with cbc
vuldb·2026-08-26·CVSS 6.5
CVE-2026-47842 [MEDIUM] VMware Spring Security up to 7.1.0 Initialization Vector predictable iv with cbc
A vulnerability was found in VMware Spring Security up to 7.1.0. It has been declared as problematic. This impacts an unknown function of the component Initialization Vector. Such manipulation leads to generation of predictable iv with cbc mode.
This vulnerability is traded as CVE-2026-47842. The attack may be launched remotely. There is no exploit available.
Red Hat
org.springframework.security/spring-security-core: Spring Security: Information disclosure via deterministic AES/CBC encryption
vendor_redhat·2026-08-26·CVSS 6.5
CVE-2026-47842 [MEDIUM] CWE-1204 org.springframework.security/spring-security-core: Spring Security: Information disclosure via deterministic AES/CBC encryption
org.springframework.security/spring-security-core: Spring Security: Information disclosure via deterministic AES/CBC encryption
A flaw was found in Spring Security. Applications configured to use AesBytesEncryptor with a two-argument constructor or a null Initialization Vector (IV) generator in Cipher Block Chaining (CBC) mode will encrypt data using a predictable, all-zero IV. This deterministic encryption allows an attacker to analyze encrypted data and potentially deduce patterns, leading to the disclosure of sensitive information.
Statement: A flaw was found in Spring Security. Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a fixed all-zero initialization vector.
No detection rules found.
No public exploits indexed.
2026-08-26
Published