CVE-2026-47842: CWE-329 Generation of Predictable IV with CBC Mode in Spring Spring Security

This vulnerability involves the generation of a predictable initialization vector (IV) when using AES encryption in CBC mode within Spring Security's AesBytesEncryptor. Specifically, when the two-argument constructor or a null IV generator is used, the encryption process defaults to a null (all-zero) IV, which is predictable and weakens the encryption. Affected versions include Spring Security 5.7.0 through 7.1.0 in various subversions. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. No known exploits are reported in the wild and no official remediation level or patch is documented in the provided data.

The use of a predictable (null) initialization vector in AES/CBC encryption compromises the confidentiality of encrypted data. Attackers may be able to analyze ciphertext patterns due to the fixed IV, potentially leading to partial data disclosure. However, integrity and availability are not impacted. The vulnerability requires network access and low privileges, with no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using the two-argument constructor or passing a null IV generator with CBC mode in AesBytesEncryptor. Consider using alternative encryption configurations that ensure a properly randomized IV.