Weakness in Password Hash Handler of Ulises Bocchio Jasypt-Spring-Boot
CVE-2026-9370

6.3MEDIUM

Key Information:

Vendor: Ulisesbocchio
Status: Jasypt-spring-boot
Vendor: CVE Published:; 24 May 2026

🔔 Create Ulisesbocchio Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-9370?

A security vulnerability has been discovered in the Ulises Bocchio jasypt-spring-boot library, specifically within the Password Hash Handler component. The flaw resides in the getSecretKeySaltGenerator function, which may allow attackers to leverage a predictable salt value when performing one-way hashing. This vulnerability poses a risk to password security and can be exploited remotely. While the attack's complexity is high, public release of the exploit increases the likelihood of potential attacks. The issue has been acknowledged by the project but remains unaddressed as of now.

Affected Version(s)

jasypt-spring-boot 3.0.0

jasypt-spring-boot 3.0.1

jasypt-spring-boot 3.0.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-9370 - Proof of Concept