CVE-2026-9370
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A weakness has been identified in jasypt-spring-boot up to version 3.0.5/4.0.4 in the getSecretKeySaltGenerator function of SimpleGCMConfig.java. Manipulation can lead to use of a one-way hash with a predictable salt. The attack can be launched remotely but requires high complexity and is difficult to exploit.
Risk Assessment
The organization is at risk of an attacker recovering passwords or cryptographic keys by predicting the salt used for hashing. This could lead to a breach of credential confidentiality.
Recommendation
Immediately update jasypt-spring-boot to version 3.0.6/4.0.5 or later once released. Until a patch is available, consider using an alternative salt generation mechanism.
Original NVD description (English source)
A weakness has been identified in ulisesbocchio jasypt-spring-boot up to 3.0.5/4.0.4. Affected by this vulnerability is the function getSecretKeySaltGenerator of the file jasypt-spring-boot/src/main/java/com/ulisesbocchio/jasyptspringboot/encryptor/SimpleGCMConfig.java of the component Password Hash Handler. Executing a manipulation can lead to use of a one-way hash with a predictable salt. The attack can be launched remotely. The attack requires a high level of complexity. The exploitation appears to be difficult. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.