CVE-2026-9370

What it actually does

The vulnerability is a cryptographic weakness in jasypt-spring-boot's password/hash handling logic, specifically in SimpleGCMConfig.getSecretKeySaltGenerator. Affected versions up to 3.0.5 and 4.0.4 may generate or use a predictable salt with a one-way hash. Predictable salts reduce the effectiveness of password-derived cryptographic material because attackers can precompute or more efficiently test candidate secrets if they obtain relevant encrypted values, hashes, configuration secrets, or application artifacts. The CVSS score is low because exploitation is complex and the expected direct impact is limited primarily to confidentiality.

Why it matters to the business

Organizations using affected jasypt-spring-boot versions may have weaker protection for encrypted application configuration values or password-derived cryptographic material. If an attacker can obtain protected configuration data or related artifacts, this flaw may make offline guessing or cryptographic analysis easier, potentially exposing secrets such as credentials, tokens, or connection strings. Public exploit information is available, but EPSS is very low, the attack complexity is high, and this is not currently listed in CISA KEV, so remediation should be prioritized as a defense-in-depth cryptographic hardening task rather than an emergency internet-wide exploitation event.

How an attack unfolds

An attacker first identifies an application that uses vulnerable versions of ulisesbocchio jasypt-spring-boot. The attacker then attempts to obtain encrypted configuration values, application packages, source code, container images, deployment artifacts, backups, logs, or other material that reveals how protected values are generated or stored. If the application relies on the vulnerable password hash handling path, the predictable salt behavior can reduce the cost of testing candidate passwords or deriving cryptographic material. Successful exploitation may allow the attacker to recover or validate secrets offline, depending on what encrypted material and password candidates are available. Because exploitation requires specific implementation conditions and useful supporting artifacts, real-world exploitation is expected to be difficult.

How to fix it

Upgrade jasypt-spring-boot when a vendor-maintained fixed release becomes available. Because the advisory states that the project had not responded and no fixed versions are provided, organizations should also consider compensating controls: avoid vulnerable code paths where possible, migrate sensitive configuration protection to a maintained secrets-management system, rotate any secrets protected by affected versions after migration, and ensure high-entropy master passwords or keys are used. Where feasible, replace predictable or framework-managed salt behavior with a vetted cryptographic implementation that uses unique, unpredictable salts or nonces generated by a cryptographically secure random source. Rebuild and redeploy applications after dependency changes, and verify that transitive dependencies do not reintroduce affected versions.

How to confirm the fix worked

Confirm exposure by generating a software bill of materials or dependency tree for Java applications and checking for com.github.ulisesbocchio:jasypt-spring-boot or related jasypt-spring-boot artifacts at versions 3.0.5, 4.0.4, or earlier. Inspect packaged JARs, container images, Maven/Gradle lockfiles, and build manifests for vulnerable versions. Validate remediation by confirming the vulnerable dependency is removed, upgraded, or replaced in the final runtime artifact, not only in source manifests. Where a replacement secrets-management approach is implemented, verify that encrypted configuration values have been re-encrypted and associated credentials or tokens have been rotated.

Typical attack path

1. Identify applications or services using jasypt-spring-boot versions up to 3.0.5 or 4.0.4.
2. Determine whether the application uses the affected SimpleGCMConfig password/hash handling path.
3. Acquire encrypted configuration values, application artifacts, repositories, backups, logs, container images, or build outputs that contain protected values or relevant cryptographic context.
4. Use the predictable salt behavior to optimize offline guessing or validation of candidate secrets.
5. If secrets are recovered, use them to access downstream systems such as databases, APIs, message brokers, or administrative services.

How to detect it

This weakness is primarily exploitable through offline analysis after an attacker obtains encrypted values or application artifacts, so there may be no direct network indicator. To assess possible prior exploitation, review source-code repository access logs, artifact repository downloads, CI/CD job logs, container registry pulls, backup access records, and object storage audit logs for unusual access to application packages, configuration files, encrypted property files, or build outputs. Check application and deployment logs for accidental exposure of jasypt master passwords, encrypted configuration values, or decrypted secrets. Investigate unusual authentication attempts against downstream services protected by secrets stored in affected applications, especially after suspicious artifact access. Look for public exploit testing or dependency enumeration activity in web logs only if the application exposes build metadata, actuator endpoints, dependency manifests, or error pages that reveal library versions.

• com.github.ulisesbocchio:jasypt-spring-boot
• jasypt-spring-boot-3.0.5.jar
• jasypt-spring-boot-4.0.4.jar
• jasypt-spring-boot/src/main/java/com/ulisesbocchio/jasyptspringboot/encryptor/SimpleGCMConfig.java
• com.ulisesbocchio.jasyptspringboot.encryptor.SimpleGCMConfig
• getSecretKeySaltGenerator
• jasypt.encryptor.password
• jasypt.encryptor.gcm-secret-key-salt
• ENC(

What your security team should do

• Inventory Java applications, container images, and build pipelines for jasypt-spring-boot versions up to 3.0.5 and 4.0.4.
• Prioritize applications that protect production credentials, API tokens, database passwords, or other high-value secrets with jasypt-spring-boot.
• Monitor the upstream project and package repositories for an official patched release or maintainer guidance.
• Plan migration to a maintained secrets-management service or a vetted cryptographic implementation if no official fix is released promptly.
• Rotate secrets that were protected by affected versions after remediation, especially where encrypted values or application artifacts may have been exposed.
• Search source repositories, artifact stores, CI/CD logs, backups, and container registries for leaked encrypted configuration values and jasypt master passwords.
• Add dependency policy checks to prevent new deployments of affected jasypt-spring-boot versions.