CVE-2026-9370 Details
Description
A weakness has been identified in ulisesbocchio jasypt-spring-boot up to 3.0.5/4.0.4. Affected by this vulnerability is the function getSecretKeySaltGenerator of the file jasypt-spring-boot/src/main/java/com/ulisesbocchio/jasyptspringboot/encryptor/SimpleGCMConfig.java of the component Password Hash Handler. Executing a manipulation can lead to use of a one-way hash with a predictable salt. The attack can be launched remotely. The attack requires a high level of complexity. The exploitation appears to be difficult. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
A vulnerability exists in the Jasypt-Spring-Boot library, specifically in versions up to 3.0.5 and 4.0.4, within the Password Hash Handler component. The issue arises because the function responsible for generating salt for key derivation defaults to a deterministic zero-salt when the user does not provide a custom salt. This predictable salt, combined with a low iteration count for the PBKDF2 key derivation process, creates weak cryptographic defaults that can be exploited. The vulnerability allows for cross-deployment key reuse and offline brute-force attacks against weak master passwords.
Users can manually set 'jasypt.encryptor.gcm-secret-key-salt' to a random value in base64 format to avoid the zero-salt default. It is also recommended to raise the PBKDF2 iteration count to 600,000, in line with current OWASP guidelines.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 24, 2026CISA-ADP
Assessed May 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/dntyfate/cve/issues/3 | [email protected] | ExploitTechnical Description |
| https://github.com/ulisesbocchio/jasypt-spring-boot/ | [email protected] | ProductVendor |
| https://github.com/ulisesbocchio/jasypt-spring-boot/issues/431 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/submit/813198 | [email protected] | Permission Required |
| https://vuldb.com/vuln/365333 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/365333/cti | [email protected] | Permission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-759 | Use of a One-Way Hash without a Salt | [email protected] |
| CWE-760 | Use of a One-Way Hash with a Predictable Salt | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ulisesbocchio jasypt-spring-boot | >= 3.0.0, <= 4.0.5-SNAPSHOT (semver) |
CPE
Remediation
| |
| ulisesbocchio jasypt-spring-boot-starter | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 24, 2026 | New CVE Received | [email protected] |