CVE-2025-22234 — Spring Security - BCrypt Password Encoder maximum password length breaks timing attack mitigation

CVE-2025-22234

Spring Security - BCrypt Password Encoder maximum password length breaks timing attack mitigation PUBLISHED

Description (CNA)

The fix applied in CVE-2025-22228 inadvertently broke the timing attack mitigation implemented in DaoAuthenticationProvider. This can allow attackers to infer valid usernames or other authentication behavior via response-time differences under certain configurations.

Affected (CNA)

Vendor / product	Versions
Spring / Spring Security	affected 5.7.16; affected 5.8.18; affected 6.0.16; affected 6.1.14; affected 6.2.10; affected 6.3.8; affected 6.4.4

CWE

CWE-208

References

https://spring.io/security/cve-2025-22234/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.