Description
Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null (all-zero) initialization vector.
Spring Security 7.1.0
Spring Security 7.0.0 - 7.0.6
Spring Security 6.5.0 - 6.5.11
Spring Security 6.4.0 - 6.4.18
Spring Security 5.8.0 - 5.8.27
Spring Security 5.7.0 - 5.7.25
Published: 2026-08-26
Score: 6.5 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

AesBytesEncryptor uses a null (all‑zero) initialization vector when constructed with two arguments or when the IV generator is null, causing the AES/CBC encryption to be deterministic. This determinism enables an adversary to correlate ciphertext blocks and infer information about the plaintext without the key.

Affected Systems

Spring Security versions from 5.7.0 through 7.1.0 are affected, including the 5.7.x, 5.8.x, 6.4.x, 6.5.x, 7.0.x and the latest 7.1.0 releases.

Risk and Exploitability

The CVSS score of 6.5 indicates a moderate risk. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the use of a hard‑coded or null IV in applications that employ AesBytesEncryptor, allowing an attacker who can observe the encrypted output to perform ciphertext correlation attacks and reduce the uncertainty about the underlying plaintext. No remote code execution is possible, but the confidentiality of sensitive data is compromised.

Generated by OpenCVE AI on August 26, 2026 at 20:38 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Spring Security to a version that includes the fix (e.g., 7.2.0 or later).
  • If an upgrade is not immediately possible, instantiate AesBytesEncryptor with a proper IV generator or provide a non‑null, random IV when encrypting.
  • Review code to ensure no accidental usage of the two‑argument constructor or a null IV generator, and audit any encrypted data for patterns before the fix is applied.

Generated by OpenCVE AI on August 26, 2026 at 20:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://spring.io/security/cve-2026-47842 cve-icon cve-icon
History

Wed, 26 Aug 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Spring
Spring spring Security
Weaknesses CWE-327
CWE-330
Vendors & Products Spring
Spring spring Security

Wed, 26 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 26 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Description Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null (all-zero) initialization vector. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18 Spring Security 5.8.0 - 5.8.27 Spring Security 5.7.0 - 5.7.25
Title Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext Correlation
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Spring Spring Security
cve-icon MITRE

Status: PUBLISHED

Assigner: vmware

Published:

Updated: 2026-08-26T19:45:25.424Z

Reserved: 2026-05-20T10:00:51.004Z

Link: CVE-2026-47842

cve-icon Vulnrichment

Updated: 2026-08-26T19:45:19.360Z

cve-icon NVD

Status : Received

Published: 2026-08-26T20:17:25.753

Modified: 2026-08-26T20:17:25.753

Link: CVE-2026-47842

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-26T20:45:03Z

Weaknesses
  • CWE-327

    Use of a Broken or Risky Cryptographic Algorithm

  • CWE-330

    Use of Insufficiently Random Values