Is there a public PoC exploit available for CVE-2026-9370?

Yes, a public proof-of-concept exploit is available for CVE-2026-9370. Prioritise patching immediately. EPSS: 0.0%.

Jasypt Spring Boot CVE-2026-9370

Q: What is the CVSS score of CVE-2026-9370?

CVE-2026-9370 has a CVSS 4.0 base score of 2.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31584 LOW

Use of a One-Way Hash with a Predictable Salt (CWE-760)

2026-05-24 VulDB

GHSA-jgj7-c8vj-w563

Information Disclosure Java

2.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.9 LOW

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

May 26, 2026 - 20:07 NVD

3.7 (LOW) 2.9 (LOW)

Analysis Generated

May 24, 2026 - 10:15 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

6 maven packages depend on com.github.ulisesbocchio:jasypt-spring-boot (1 direct, 5 indirect)
5 maven packages depend on com.github.ulisesbocchio:jasypt-spring-boot-starter (3 direct, 2 indirect)

Ecosystem-wide dependent count for version 3.0.0 and other introduced versions.

DescriptionCVE.org

A weakness has been identified in ulisesbocchio jasypt-spring-boot up to 3.0.5/4.0.4. Affected by this vulnerability is the function getSecretKeySaltGenerator of the file jasypt-spring-boot/src/main/java/com/ulisesbocchio/jasyptspringboot/encryptor/SimpleGCMConfig.java of the component Password Hash Handler. Executing a manipulation can lead to use of a one-way hash with a predictable salt. The attack can be launched remotely. The attack requires a high level of complexity. The exploitation appears to be difficult. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Cryptographic salt generation in Jasypt Spring Boot library (versions ≤3.0.5 and ≤4.0.4) uses predictable values, enabling offline password cracking attacks against encrypted configuration properties. The SimpleGCMConfig class's getSecretKeySaltGenerator function generates salts without sufficient entropy, reducing the computational cost for attackers who obtain encrypted passwords to derive plaintext through dictionary or brute-force attacks. Public exploit code exists (POC available) with EPSS indicating low probability of widespread exploitation (3.7 CVSS, AC:H). Vendor has not responded to responsible disclosure as of analysis date.

Technical ContextAI

Jasypt Spring Boot is a Java library that provides integration between the Java Simplified Encryption (Jasypt) library and Spring Boot applications, commonly used to encrypt sensitive configuration properties like database passwords, API keys, and credentials in application.properties or YAML files. The vulnerability (CWE-760: Use of a One-Way Hash with a Predictable Salt) exists in the SimpleGCMConfig class's salt generation mechanism for GCM (Galois/Counter Mode) encryption. When salts are predictable or reused, attackers who gain access to encrypted configuration files can conduct offline attacks using precomputed rainbow tables or optimized brute-force techniques. The CPE cpe:2.3:a:ulisesbocchio:jasypt-spring-boot:*:*:*:*:*:*:*:* indicates the library itself is vulnerable, affecting any Spring Boot application that depends on these versions for property encryption. This is particularly concerning in containerized environments where configuration files may be exposed through image layers, CI/CD logs, or backup systems.

RemediationAI

No vendor-released patch is available as the project maintainer has not responded to vulnerability disclosure (GitHub issue #431). Organizations using jasypt-spring-boot ≤3.0.5 or ≤4.0.4 should implement one of these mitigations: (1) Migrate to external secret management solutions like HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, or Spring Cloud Config Server with encryption backends, which provide cryptographically secure key derivation and rotation capabilities (trade-off: infrastructure complexity and operational overhead increase). (2) Fork the jasypt-spring-boot repository, apply custom fixes to SimpleGCMConfig.getSecretKeySaltGenerator() to use cryptographically secure random salt generation (SecureRandom with sufficient entropy), and maintain the fork internally (trade-off: ongoing maintenance burden and lack of upstream security updates). (3) If immediate migration is infeasible, implement compensating controls: enforce strict filesystem permissions on configuration files (readable only by application service accounts), use encrypted filesystems or volumes for property files, implement configuration file integrity monitoring, and rotate all encrypted credentials while re-encrypting with stronger external tools (trade-off: does not eliminate vulnerability, only reduces exposure surface). Monitor the vendor repository at https://github.com/ulisesbocchio/jasypt-spring-boot/ for future security releases. For technical implementation details of the exploit, security teams can reference https://github.com/dntyfate/cve/issues/3.