vetkit.java.crypto.rsa-without-oaep

RSA encryption uses PKCS#1 v1.5 or no padding instead of OAEP.

Last updated: 2026-11-01

Suite: Security

java

RSA encryption uses PKCS#1 v1.5 or no padding instead of OAEP.

Category: SECURITY · Engine rule severity: WARNING

How to fix it

Use RSA/ECB/OAEPWithSHA-256AndMGF1Padding, or a hybrid scheme with an authenticated symmetric cipher.

References

https://cwe.mitre.org/data/definitions/780.html

Source: packages/engine/rules/sast/java.yml.

Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.