Ulisesbocchio · Jasypt-Spring-Boot · CVE-2026-9370
**Name of the Vulnerable Software and Affected Versions**
ulisesbocchio jasypt-spring-boot versions prior to 3.0.6
ulisesbocchio jasypt-spring-boot versions prior to 4.0.5
**Description**
A weakness in the Password Hash Handler component allows for the use of a one-way hash with a predictable salt. This issue is located in the `getSecretKeySaltGenerator()` function within the `jasypt-spring-boot/src/main/java/com/ulisesbocchio/jasyptspringboot/encryptor/SimpleGCMConfig.java` file. A remote attacker can exploit this through manipulation, although the attack requires a high level of complexity and is difficult to execute.
**Recommendations**
At the moment, there is no information about a newer version that contains a fix for this vulnerability.