CVE-2026-47842

Name of the Vulnerable Software and Affected Versions Spring Security version 7.1.0 Spring Security versions 7.0.0 through 7.0.6 Spring Security versions 6.5.0 through 6.5.11 Spring Security versions 6.4.0 through 6.4.18 Spring Security versions 5.8.0 through 5.8.27 Spring Security versions 5.7.0 through 5.7.25

Description Applications using AesBytesEncryptor with the two-argument constructor, or when providing a null IV generator while using CBC as the encryption mode, encrypt data with AES/CBC using a null (all-zero) initialization vector. An initialization vector (IV) is a random value used to ensure that the same plaintext encrypts to different ciphertexts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.