## cve-2026-47842 - MEDIUM - Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext Correlation

- 種別: advisory
- 関連技術: spring, java
- CVE: CVE-2026-47842, CVE-2020-5408
- 公開日時: 2026-08-20T00:00:00.000Z
- 情報源: Spring Security Advisories (https://spring.io/security/cve-2026-47842)
- パーマリンク: https://vulnpulse.app/items/spring-security-91bc696d1696

This is a continuation of CVE-2020-5408 . Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null (all-zero) initialization vector. Because the IV is fixed, identical plaintexts always produce identical ciphertext for a given password and salt, regardless of when or how many times the value was encrypted. An attacker with read access to the encrypted data store can exploit this property to determine when two records share the same plaintext value, correlate encrypted values…