CVE-2026-9370

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-9370
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-9370.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-9370
Aliases
Published
2026-05-24T09:15:09.292Z
Modified
2026-07-08T08:11:41.620273181Z
Severity
  • 2.9 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
ulisesbocchio jasypt-spring-boot Password Hash SimpleGCMConfig.java getSecretKeySaltGenerator hash predictable salt
Details

A weakness has been identified in ulisesbocchio jasypt-spring-boot up to 3.0.5/4.0.4. Affected by this vulnerability is the function getSecretKeySaltGenerator of the file jasypt-spring-boot/src/main/java/com/ulisesbocchio/jasyptspringboot/encryptor/SimpleGCMConfig.java of the component Password Hash Handler. Executing a manipulation can lead to use of a one-way hash with a predictable salt. The attack can be launched remotely. The attack requires a high level of complexity. The exploitation appears to be difficult. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9370.json",
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-759",
        "CWE-760"
    ]
}
References

Affected packages

Git / github.com/ulisesbocchio/jasypt-spring-boot

Affected ranges

Type
GIT
Repo
https://github.com/ulisesbocchio/jasypt-spring-boot
Events
Introduced
a82c45caf5d910d7e7684a50144b5127125b437c
Last affected
a5b660c50ab784543aa5bf727cf94bbdc802c523
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "3.0.0"
        },
        {
            "last_affected": "3.0.0"
        },
        {
            "introduced": "3.0.1"
        },
        {
            "last_affected": "3.0.1"
        },
        {
            "introduced": "3.0.2"
        },
        {
            "last_affected": "3.0.2"
        },
        {
            "introduced": "3.0.3"
        },
        {
            "last_affected": "3.0.3"
        },
        {
            "introduced": "3.0.4"
        },
        {
            "last_affected": "3.0.4"
        },
        {
            "introduced": "3.0.5"
        },
        {
            "last_affected": "3.0.5"
        },
        {
            "introduced": "4.0.0"
        },
        {
            "last_affected": "4.0.0"
        },
        {
            "introduced": "4.0.1"
        },
        {
            "last_affected": "4.0.1"
        },
        {
            "introduced": "4.0.2"
        },
        {
            "last_affected": "4.0.2"
        },
        {
            "introduced": "4.0.3"
        },
        {
            "last_affected": "4.0.3"
        },
        {
            "introduced": "4.0.4"
        },
        {
            "last_affected": "4.0.4"
        }
    ]
}

Affected versions

3.*
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
4.*
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
jasypt-spring-boot-parent-3.*
jasypt-spring-boot-parent-3.0.0
jasypt-spring-boot-parent-3.0.1
jasypt-spring-boot-parent-3.0.2
jasypt-spring-boot-parent-3.0.3
jasypt-spring-boot-parent-3.0.4
jasypt-spring-boot-parent-3.0.5
jasypt-spring-boot-parent-4.*
jasypt-spring-boot-parent-4.0.0
jasypt-spring-boot-parent-4.0.1
jasypt-spring-boot-parent-4.0.2
jasypt-spring-boot-parent-4.0.3
jasypt-spring-boot-parent-4.0.4
v3.*
v3.0.4
v3.0.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-9370.json"