Skip to main content

Inadequate Encryption Strength

CVE-2026-47842

Medium
6.5/10

Summary

Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null (all-zero) initialization vector. This issue affects Spring Security versions from 5.7.0 through 5.7.25, 5.8.0 through 5.8.27, 6.4.0 through 6.4.18, 6.5.0 through 6.5.11, 7.0.0 through 7.0.6 and 7.1.0.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • LOW
  • HIGH
  • NONE

CWE-326 - Inadequate Encryption Strength

The software stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

References

Advisory Timeline

  • Published