CLEANSTART-2026-DN56273 Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null (all-zero) initializ...

🗓️ 08 Oct 2026 00:43:15Reported by GoogleType

osv🔗 osv.dev👁 5 Views

Insecure encryption in apache-nifi-registry AesBytesEncryptor uses a null IV.

Reporter	Title	Published	Views	Family All 16
Circl	CVE-2026-47842	26 Aug 202620:21	–	circl
CVE	CVE-2026-47842	26 Aug 202619:22	–	cve
Cvelist	CVE-2026-47842 Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext Correlation	26 Aug 202619:22	–	cvelist
EUVD	EUVD-2026-66677	26 Aug 202619:22	–	euvd
NVD	CVE-2026-47842	26 Aug 202620:17	–	nvd
OSV	CLEANSTART-2026-EC45528 Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5	10 Sep 202602:58	–	osv
OSV	CLEANSTART-2026-OB74177 Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5	11 Sep 202600:41	–	osv
OSV	CLEANSTART-2026-OS01121 Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null (all-zero) initializ...	6 Oct 202600:34	–	osv
OSV	CLEANSTART-2026-QY38876 Security fix for CVE-2026-47842 applied in: apache-nifi 2.10.0-r8, spring-boot 3.4.13-r3	18 Sep 202609:28	–	osv
Positive Technologies	PT-2026-82246	26 Aug 202600:00	–	ptsecurity

Source	Link
github	www.github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-DN56273.json
osv	www.osv.dev/vulnerability/CVE-2026-47842
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-47842

08 Oct 2026 01:15Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.16.5

EPSS0.0015

apache-nifi-registry AesBytesEncryptor AES/CBC null initialization vector