CVE-2026-47842
CVE-2026-47842: 2 tracked advisory records across Red Hat, VMware. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityMedium6.5
Medium [CVE-2026-47842] org.springframework.security/spring-security-core: Spring Security: Information disclosure via deterministic AES/CBC encryption
CVE-2026-47842Source published Source updated
Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null (all-zero) initialization vector. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18 Spring Security 5.8.0 - 5.8.27 Spring Security 5.7.0 - 5.7.25 This deterministic encryption allows an attacker to analyze encrypted data and potentially deduce patterns, leading to the disclosure of sensitive information. Because the IV is deterministic, identical plaintexts always produce identical ciphertext for a given password and salt. An attacker with read access to the encrypted data store can exploit this to determine when two records share the same plaintext…
- Affected products in this advisory
- OpenShift Developer Tools and Services
- Red Hat Fuse 7
- Red Hat OpenShift Dev Spaces
- Red Hat Single Sign-On 7
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- Upgrade to a fixed version of Spring Security (7.1.1, 7.0.7, 6.5.12, 6.4.19, 5.8.28, or 5.7.26). Alternatively, migrate from the deprecated AesBytesEncryptor to the new AesCbcBytesEncryptor or AesGcmBytesEncryptor classes which use secure random IV generation. If using Encryptors.standard(), Encryptors.stronger(), Encryptors.text(), or Encryptors.delux(), these are also deprecated and should be replaced. Review the Spring Security migration guide to determine whether data re-encryption is required.
VMware
1 advisory- Advisory severityMedium6.5
Medium [CVE-2026-47842] Spring Security: Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as…
CVE-2026-47842Source published Source updated
Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null (all-zero) initialization vector. Spring Security 7.1.0
- Affected products in this advisory
- Spring Security
- Source-reported affected versions
- Spring Security 7.1.0
- Spring Security 7.0.0 through 7.0.6
- Spring Security 6.5.0 through 6.5.11
- Spring Security 6.4.0 through 6.4.18
2 more entries in the full advisory.
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- No mitigation guidance extracted; consult the source.
Android app · Google Play
Turn CVE research into alerts on your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.