CVE-2025-22234

🗓️ 22 Jan 2026 21:02:23Reported by AttackerKBType

The fix for CVE-2025-22228 breaks timing protection in DaoAuthenticationProvider, enabling inference via response times.

Reporter	Title	Published	Views	Family All 119
IBM Security Bulletins	Security Bulletin: Vulnerabilities in old Spring Framework versions affect watsonx.data	13 Jun 202510:20	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining 2.0.2	21 Jun 202513:39	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite Ai-Broker Component vulnerable to BCryptPasswordEncoder will incorrectly return true for passwords larger than 72 characters.	28 Mar 202520:22	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability with spring-security-crypto and jinja affect IBM Cloud Object Storage Systems (July 2025)	1 Aug 202516:01	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability assertj-core, spring-security-crypto, werkzeug, urllib, libsodium, jersey-client, log4j, dmidecode-dmidecode, and aide affect IBM Cloud Object Storage Systems (FEB 2026)	27 Feb 202617:30	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities in IBM Business Automation Manager Open Editions.	30 Jun 202523:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Engineering Requirements Management DOORS/DWA vulnerabilities addressed in 9.7.2.10	29 Jul 202522:30	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in dependencies affect IBM Common Licensing	3 Sep 202504:55	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Control Center is affected by vulnerabilities in Spring boot and Spring Security	24 Oct 202506:57	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerability in Spring Security affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-22228)	27 Jul 202622:04	–	ibm