Not Using an Unpredictable IV with CBC Mode in Spring Security - CVE-2026-47842
Published: August 28, 2026
Vulnerability identifier: #VU146240
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-47842
CWE-ID: CWE-329
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to the use of a fixed initialization vector in AesBytesEncryptor when encrypting data with the two-argument constructor or with a null IV generator and CBC mode. A remote user can read encrypted records and compare deterministic ciphertext values to disclose sensitive information.
This issue enables correlation of identical plaintext values across encrypted records and can support dictionary attacks by comparing pre-encrypted candidate values.
Affected software
Spring Security
How to mitigate CVE-2026-47842
Install security update from vendor's website.
Spring Security - addressed in versions 5.7.26, 5.8.28, 6.4.19, 6.5.12, 7.0.6.1, 7.0.7, 7.1.0.1, 7.1.1