← CVE Intelligence

CVE-2025-22228

CVE-2025-22228: Spring Security BCryptPasswordEncoder does not enforce maximum password length PUBLISHED

Description (CNA)

BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same.

Affected (CNA)

Vendor / productVersions
Spring / Spring Securityaffected 5.7.x before 5.7.16; affected 5.8.x before 5.8.18; affected 6.0.x before 6.0.16; affected 6.1.x before 6.1.14; affected 6.2.x before 6.2.10; affected 6.3.x before 6.3.8; affected 6.4.x before 6.4.4

CWE

No CWE identifiers supplied.

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.