Zennoxa Shield
Rules / Java
SHIELD-JAVA-009

Weak Hash Algorithm

mediumJavaCWE-328CVSS 5.9

What it detects

MessageDigest using MD5 or SHA-1 is cryptographically broken and unsuitable for security use.

How to fix

Use SHA-256 or stronger; for passwords use bcrypt, scrypt, or Argon2.

Vulnerable — Shield flags thisFileIntegrity.java
import java.security.MessageDigest;

public class FileIntegrity {
    public byte[] checksum(byte[] content) throws Exception {
        MessageDigest digest = MessageDigest.getInstance("MD5");
        return digest.digest(content);
    }
}
Fixed — scans cleanFileIntegrity.java
import java.security.MessageDigest;

public class FileIntegrity {
    public byte[] checksum(byte[] content) throws Exception {
        MessageDigest digest = MessageDigest.getInstance("SHA-256");
        return digest.digest(content);
    }
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-JAVA-009, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-JAVA-009: Weak Hash Algorithm — Zennoxa Shield