CVE-2025-22234

🗓️ 22 Jan 2026 21:02:23Reported by vmwareType

cve🔗 web.nvd.nist.gov📰️ 5 Media mentions👁 406 Views

Fix for CVE-2025-22228 broke DaoAuthenticationProvider timing mitigation, enabling username inference via response time differences.

Reporter	Title	Published	Views	Family All 23
IBM Security Bulletins	Security Bulletin: Vulnerability assertj-core, spring-security-crypto, werkzeug, urllib, libsodium, jersey-client, log4j, dmidecode-dmidecode, and aide affect IBM Cloud Object Storage Systems (FEB 2026)	27 Feb 202617:30	–	ibm
ATTACKERKB	CVE-2025-22234	22 Jan 202621:02	–	attackerkb
BDU FSTEC	The vulnerability of the Java framework for securing industrial applications using Spring Security involves a flaw in the data protection mechanism, allowing attackers to compromise the integrity of the protected information.	14 May 202500:00	–	bdu_fstec
Circl	CVE-2025-22234	23 Apr 202503:24	–	circl
CNNVD	Spring Security security vulnerabilities	22 Jan 202600:00	–	cnnvd
Cvelist	CVE-2025-22234 Spring Security - BCrypt Password Encoder maximum password length breaks timing attack mitigation	22 Jan 202621:02	–	cvelist
EUVD	EUVD-2026-3787	22 Jan 202621:02	–	euvd
Github Security Blog	Spring Security has a broken timing attack mitigation implemented in DaoAuthenticationProvide	22 Jan 202621:33	–	github
NVD	CVE-2025-22234	22 Jan 202621:15	–	nvd
OSV	GHSA-VQXH-445G-37FC Spring Security has a broken timing attack mitigation implemented in DaoAuthenticationProvide	22 Jan 202621:33	–	osv

[
  {
    "collectionURL": "https://spring.io/projects/spring-security",
    "defaultStatus": "affected",
    "product": "Spring Security",
    "vendor": "Spring",
    "versions": [
      {
        "status": "affected",
        "version": "5.7.16",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "5.8.18",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "6.0.16",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "6.1.14",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "6.2.10",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "6.3.8",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "6.4.4",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
spring	www.spring.io/security/cve-2025-22234/

17 Jun 2026 08:45Current

5.5Medium risk

Vulners AI Score5.5

CVSS 3.15.3

EPSS0.00402

SSVC

CWE-208